{"record":{"id":"be38d3d137f9a8db","repo":"Tencent/WeKnora","slug":"schema-qualified-function-calls-are-not-allowed","errorCode":null,"errorMessage":"schema-qualified function calls are not allowed: %s","messagePattern":"schema-qualified function calls are not allowed: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":2192,"sourceCode":"\n// validateFuncCall validates a function call\nfunc (v *sqlValidator) validateFuncCall(fc *pg_query.FuncCall, result *SQLValidationResult) error {\n\t// Get function name\n\tfuncName := \"\"\n\tfor _, namePart := range fc.Funcname {\n\t\tif s := namePart.GetString_(); s != nil {\n\t\t\tfuncName = strings.ToLower(s.Sval)\n\t\t}\n\t}\n\n\t// Check for schema-qualified function calls\n\tif v.checkSchemaAccess && len(fc.Funcname) > 1 {\n\t\tschemaName := \"\"\n\t\tif s := fc.Funcname[0].GetString_(); s != nil {\n\t\t\tschemaName = strings.ToLower(s.Sval)\n\t\t}\n\t\tif schemaName != \"\" && schemaName != \"pg_catalog\" {\n\t\t\treturn fmt.Errorf(\"schema-qualified function calls are not allowed: %s\", schemaName)\n\t\t}\n\t}\n\n\t// Block dangerous function prefixes\n\tif v.checkDangerousFuncs {\n\t\tdangerousPrefixes := []string{\n\t\t\t\"pg_\",     // All pg_* functions (pg_read_file, pg_reload_conf, pg_stat_*, etc.)\n\t\t\t\"lo_\",     // Large object functions (lo_import, lo_export, lo_from_bytea, lo_put, etc.)\n\t\t\t\"dblink\",  // Database link functions\n\t\t\t\"file_\",   // File functions\n\t\t\t\"copy_\",   // Copy functions\n\t\t\t\"binary_\", // Binary functions\n\t\t}\n\t\tfor _, prefix := range dangerousPrefixes {\n\t\t\tif strings.HasPrefix(funcName, prefix) {\n\t\t\t\treturn fmt.Errorf(\"function '%s' is not allowed (dangerous prefix)\", funcName)\n\t\t\t}\n\t\t}","sourceCodeStart":2174,"sourceCodeEnd":2210,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L2174-L2210","documentation":"Function-call guard in validateFuncCall: with schema access checking enabled, the call is schema-qualified (more than one name part) and the qualifier is neither empty nor pg_catalog, so the call is rejected to block functions defined in arbitrary schemas.","triggerScenarios":"Thrown at internal/utils/inject.go:2192 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Call only whitelisted pg_catalog or unqualified functions","Remove the schema qualifier and rely on the allowed function list","Reject generated SQL that names custom schemas"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}