{"record":{"id":"b6ac735e74439c93","repo":"googleapis/mcp-toolbox","slug":"execute-immediate-is-not-allowed-when-dataset-rest","errorCode":null,"errorMessage":"EXECUTE IMMEDIATE is not allowed when dataset restrictions are in place, as its contents cannot be safely analyzed","messagePattern":"EXECUTE IMMEDIATE is not allowed when dataset restrictions are in place, as its contents cannot be safely analyzed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/tools/bigquery/bigquerycommon/table_name_parser.go","lineNumber":267,"sourceCode":"\t\t\t\t\t\treturn 0, fmt.Errorf(\"querying non-dataset-level INFORMATION_SCHEMA view %q is not allowed when dataset restrictions are in place\", viewName)\n\t\t\t\t\t}\n\t\t\t\t\tif infoSchemaIdx == 0 {\n\t\t\t\t\t\treturn 0, fmt.Errorf(\"querying INFORMATION_SCHEMA views without a dataset prefix is not allowed when dataset restrictions are in place\")\n\t\t\t\t\t}\n\t\t\t\t\tif infoSchemaIdx > 2 {\n\t\t\t\t\t\treturn 0, fmt.Errorf(\"invalid INFORMATION_SCHEMA query path %q\", strings.Join(parts, \".\"))\n\t\t\t\t\t}\n\t\t\t\t\tparts = parts[:infoSchemaIdx+1]\n\t\t\t\t}\n\n\t\t\t\tif len(parts) == 1 {\n\t\t\t\t\tkeyword := strings.ToLower(parts[0])\n\t\t\t\t\tswitch keyword {\n\t\t\t\t\tcase \"call\":\n\t\t\t\t\t\treturn 0, fmt.Errorf(\"CALL is not allowed when dataset restrictions are in place, as the called procedure's contents cannot be safely analyzed\")\n\t\t\t\t\tcase \"immediate\":\n\t\t\t\t\t\tif lastToken == \"execute\" {\n\t\t\t\t\t\t\treturn 0, fmt.Errorf(\"EXECUTE IMMEDIATE is not allowed when dataset restrictions are in place, as its contents cannot be safely analyzed\")\n\t\t\t\t\t\t}\n\t\t\t\t\tcase \"procedure\", \"function\":\n\t\t\t\t\t\tif lastToken == \"create\" || lastToken == \"create or replace\" {\n\t\t\t\t\t\t\treturn 0, fmt.Errorf(\"unanalyzable statements like '%s %s' are not allowed\", strings.ToUpper(lastToken), strings.ToUpper(keyword))\n\t\t\t\t\t\t}\n\t\t\t\t\tcase verbCreate, verbAlter, verbDrop, verbSelect, verbInsert, verbUpdate, verbDelete, verbMerge:\n\t\t\t\t\t\tif statementVerb == \"\" {\n\t\t\t\t\t\t\tstatementVerb = keyword\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\tif statementVerb == verbCreate || statementVerb == verbAlter || statementVerb == verbDrop {\n\t\t\t\t\t\tif keyword == \"schema\" || keyword == \"dataset\" {\n\t\t\t\t\t\t\treturn 0, fmt.Errorf(\"dataset-level operations like '%s %s' are not allowed when dataset restrictions are in place\", strings.ToUpper(statementVerb), strings.ToUpper(keyword))\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\tif _, ok := tableFollowsKeywords[keyword]; ok {","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/tools/bigquery/bigquerycommon/table_name_parser.go#L249-L285","documentation":"When dataset restrictions (allowedDatasets) are in effect, every table referenced by a query must be statically analyzable so access can be validated. EXECUTE IMMEDIATE runs arbitrary dynamic SQL whose table references cannot be parsed ahead of time, so parseSQL rejects it outright to prevent bypassing dataset restrictions.","triggerScenarios":"Calling TableParser/parseSQL on a statement containing the EXECUTE IMMEDIATE keyword while dataset restrictions are configured.","commonSituations":"Porting stored-procedure-style or dynamic-SQL workflows from other engines to BigQuery; generating SQL templates that build queries dynamically; users pasting scripting statements into a tool that validates table access.","solutions":["Remove the EXECUTE IMMEDIATE statement from the query","Rewrite the logic as a plain static SQL statement listing its tables explicitly","Execute the query against a tool/source without dataset restrictions, only if the user is authorized for all datasets","Perform dynamic SQL server-side in a stored procedure and call that procedure where its contents are trusted"],"exampleFix":"// before\nEXECUTE IMMEDIATE 'SELECT * FROM proj.ds.table WHERE id = 1';\n// after\nSELECT * FROM proj.ds.table WHERE id = 1;","handlingStrategy":"validation","validationCode":"if strings.Contains(strings.ToUpper(sql), \"EXECUTE IMMEDIATE\") {\n    return fmt.Errorf(\"query rejected: EXECUTE IMMEDIATE is not permitted under dataset restrictions\")\n}","typeGuard":null,"tryCatchPattern":"tables, err := parser.Parse(sql)\nif err != nil {\n    if strings.Contains(err.Error(), \"EXECUTE IMMEDIATE\") {\n        // surface a user-facing message: dynamic SQL is not allowed here\n        return err\n    }\n    return err\n}","preventionTips":["Do not use dynamic SQL (EXECUTE IMMEDIATE) in queries submitted to restricted sources","Keep queries as static SQL so table references remain analyzable","Document dataset-restriction behavior for query authors"],"tags":["bigquery","sql-parsing","dataset-restrictions","security"],"backgroundTag":"dynamic-sql-blocked","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}