{"record":{"id":"ce63c7aa2b8a703c","repo":"Tencent/WeKnora","slug":"access-to-schema-s-is-not-allowed","errorCode":null,"errorMessage":"access to schema '%s' is not allowed","messagePattern":"access to schema '(.+?)' is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/inject.go","lineNumber":1430,"sourceCode":"\n\treturn nil\n}\n\n// validateFromItem validates a FROM clause item\nfunc (v *sqlValidator) validateFromItem(node *pg_query.Node, tables map[string]string, result *SQLValidationResult) error {\n\tif node == nil {\n\t\treturn nil\n\t}\n\n\t// Handle RangeVar (simple table reference)\n\tif rv := node.GetRangeVar(); rv != nil {\n\t\ttableName := strings.ToLower(rv.Relname)\n\n\t\t// Check for schema qualification\n\t\tif v.checkSchemaAccess && rv.Schemaname != \"\" {\n\t\t\tschemaName := strings.ToLower(rv.Schemaname)\n\t\t\tif schemaName != \"public\" {\n\t\t\t\treturn fmt.Errorf(\"access to schema '%s' is not allowed\", rv.Schemaname)\n\t\t\t}\n\t\t}\n\n\t\t// Get alias\n\t\talias := tableName\n\t\tif rv.Alias != nil && rv.Alias.Aliasname != \"\" {\n\t\t\talias = strings.ToLower(rv.Alias.Aliasname)\n\t\t}\n\t\ttables[tableName] = alias\n\t\treturn nil\n\t}\n\n\t// Handle JoinExpr (JOIN)\n\tif je := node.GetJoinExpr(); je != nil {\n\t\tif err := v.validateFromItem(je.Larg, tables, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t\tif err := v.validateFromItem(je.Rarg, tables, result); err != nil {","sourceCodeStart":1412,"sourceCodeEnd":1448,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L1412-L1448","documentation":"Schema-access guard in validateFromItem: the FROM item is schema-qualified and schema access checking is enabled, but the qualifier is not 'public'. The validator rejects any non-public schema to keep queries inside the permitted namespace.","triggerScenarios":"Thrown at internal/utils/inject.go:1430 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rewrite the query without a schema qualifier so it resolves in public","Use only tables exposed in the public schema","Remove pg_catalog / system schema references"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}