{"record":{"id":"d133fb8ef2ab70a2","repo":"FlowiseAI/Flowise","slug":"invalid-table-name-d133fb","errorCode":null,"errorMessage":"Invalid table name","messagePattern":"Invalid table name","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/recordManagerSecurity.ts","lineNumber":11,"sourceCode":"export const RECORD_MANAGER_TABLE_NAME_MAX_LENGTH = 128\nexport const RECORD_MANAGER_NAMESPACE_MAX_LENGTH = 128\n\n/**\n * Validates record manager table names used in SQL identifiers.\n */\nexport function sanitizeRecordManagerTableName(tableName: string): string {\n    tableName = tableName.trim().toLowerCase().replace(/\\s+/g, '_')\n\n    if (!/^[a-zA-Z0-9_]+$/.test(tableName)) {\n        throw new Error('Invalid table name')\n    }\n\n    if (tableName.length > RECORD_MANAGER_TABLE_NAME_MAX_LENGTH) {\n        throw new Error(`Invalid table name: must be at most ${RECORD_MANAGER_TABLE_NAME_MAX_LENGTH} characters`)\n    }\n\n    return tableName\n}\n\n/**\n * Validates record manager namespace values stored in the database.\n */\nexport function sanitizeRecordManagerNamespace(namespace: string): string {\n    const trimmed = namespace.trim()\n\n    if (!/^[a-zA-Z0-9_-]{1,128}$/.test(trimmed)) {\n        throw new Error('Invalid namespace')\n    }","sourceCodeStart":1,"sourceCodeEnd":29,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/recordManagerSecurity.ts#L1-L29","documentation":"sanitizeRecordManagerTableName normalizes input (trim, lowercase, collapse whitespace to underscore) then requires the result to match ^[a-zA-Z0-9_]+$. Any character that is not an ASCII letter, digit, or underscore after normalization throws 'Invalid table name'. This is stricter than namespace validation: hyphens and dots are rejected because the value becomes a SQL identifier used in raw SQL by the record manager.","triggerScenarios":"Passing 'my-table' (hyphen), 'db.table' (dot), 'order$' ($), '' (empty after trim), 'café' (unicode), or any quoted/whitespace-only string.","commonSituations":"Deriving the table name from a free-form project/org/tenant display name; users assuming the same rules as namespaces (which allow hyphens); concatenating names with '-' or '.' separators.","solutions":["Pre-normalize the name: replace every char outside [a-z0-9_] with '_' before calling.","Use only lowercase alphanumerics and underscores as the naming convention.","Reject empty input upstream so trim() never yields ''."],"exampleFix":"// before\nsanitizeRecordManagerTableName('My-Bedrock.Table') // throws 'Invalid table name'\n\n// after\nconst safe = 'My-Bedrock.Table'.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '')\nsanitizeRecordManagerTableName(safe) // 'my_bedrock_table'","handlingStrategy":"validation","validationCode":"import { RECORD_MANAGER_TABLE_NAME_MAX_LENGTH } from './recordManagerSecurity'\n\nfunction toValidTableName(raw: string): string | null {\n  const n = raw.trim().toLowerCase().replace(/\\s+/g, '_').replace(/[^a-z0-9_]/g, '_')\n  if (!n || n.length > RECORD_MANAGER_TABLE_NAME_MAX_LENGTH) return null\n  return n\n}","typeGuard":"const isValidTableName = (s: string): boolean => /^[a-zA-Z0-9_]+$/.test(s.trim().toLowerCase().replace(/\\s+/g, '_'))","tryCatchPattern":"try {\n  return sanitizeRecordManagerTableName(input)\n} catch (e) {\n  throw new Error(`Table name '${input}' is invalid: ${(e as Error).message}`, { cause: e })\n}","preventionTips":["Restrict user-facing table-name inputs to [a-z0-9_] at the UI layer.","Replace disallowed characters with '_' before calling sanitizeRecordManagerTableName.","Remember hyphens and dots are allowed for namespaces but NOT for table names."],"tags":["validation","sql","security","record-manager"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}