{"record":{"id":"dfdd1c6e4a251412","repo":"Tencent/WeKnora","slug":"function-s-is-not-allowed","errorCode":null,"errorMessage":"function '%s' is not allowed","messagePattern":"function '(.+?)' is not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/utils/inject.go","lineNumber":2313,"sourceCode":"\t\t\t// allow reading any file on the app container.\n\t\t\t\"read_text\":         true,\n\t\t\t\"read_blob\":         true,\n\t\t\t\"read_csv\":          true,\n\t\t\t\"read_csv_auto\":     true,\n\t\t\t\"read_parquet\":      true,\n\t\t\t\"read_json\":         true,\n\t\t\t\"read_json_auto\":    true,\n\t\t\t\"read_ndjson\":       true,\n\t\t\t\"read_ndjson_auto\":  true,\n\t\t\t\"read_json_objects\": true,\n\t\t\t\"read_xlsx\":         true,\n\t\t\t\"sniff_csv\":         true,\n\t\t\t\"glob\":              true,\n\t\t\t\"st_read\":           true,\n\t\t\t\"st_read_meta\":      true,\n\t\t}\n\t\tif dangerousFunctions[funcName] {\n\t\t\treturn fmt.Errorf(\"function '%s' is not allowed\", funcName)\n\t\t}\n\t}\n\n\t// Check against whitelist if enabled\n\tif v.checkFunctionNames && !v.allowedFunctions[funcName] {\n\t\treturn fmt.Errorf(\"function not allowed: %s\", funcName)\n\t}\n\n\t// Validate function arguments recursively\n\tfor _, arg := range fc.Args {\n\t\tif err := v.validateNode(arg, result); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":2295,"sourceCodeEnd":2331,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/inject.go#L2295-L2331","documentation":"The validator's explicit blocklist rejected a function name present in the dangerousFunctions map (e.g. sniff_csv, glob, st_read, st_read_meta). These functions expose filesystem or introspection capabilities that enable RCE or data exfiltration when injected SQL is allowed. Unlike the prefix check, this matches exact names.","triggerScenarios":"Validating an expression containing a direct call to a blocklisted function such as sniff_csv('path'), glob('pattern'), st_read('file.geojson'), or st_read_meta('file') in any validated SQL node.","commonSituations":"Users attempting CSV auto-detection (sniff_csv) or spatial file reads (st_read) inside computed columns; auto-generated analytics SQL that leans on DuckDB reader functions; attacks probing for file access via glob patterns.","solutions":["Replace the blocklisted function with an allowed equivalent (e.g. parse the CSV in application code instead of sniff_csv)","Load external files through the platform's file-upload/API surface, then reference the resulting table","For spatial data, pre-convert geometry outside the expression and store it in a supported column type","If the function is safe in your deployment, extend allowedFunctions by enabling the whitelist mechanism — do not edit the blocklist"],"exampleFix":"// before\nexpr := \"st_read('zones.geojson')\"\n// after\n// import geometry via the files API first, then:\nexpr := \"ST_Contains(zone_geom, point)\" // references pre-imported table/column","handlingStrategy":"validation","validationCode":"var blocked = map[string]bool{\"sniff_csv\": true, \"glob\": true, \"st_read\": true, \"st_read_meta\": true}\nif blocked[funcName] {\n    return fmt.Errorf(\"function %q is blocklisted; load the data via the files API instead\", funcName)\n}","typeGuard":"func isBlocklistedFunction(name string) bool {\n    var blocked = map[string]bool{\"sniff_csv\": true, \"glob\": true, \"st_read\": true, \"st_read_meta\": true}\n    return blocked[strings.ToLower(name)]\n}","tryCatchPattern":"defer func() {\n    if r := recover(); r != nil { _ = r }\n}()\nif err := injector.Validate(expr); err != nil {\n    var rejected *RejectError\n    if errors.As(err, &rejected) && isBlocklistedFunction(rejected.FuncName) {\n        return nil, fmt.Errorf(\"blocked function %q\", rejected.FuncName)\n    }\n    return err\n}","preventionTips":["Provide allowlisted equivalents (e.g. app-side CSV parsing) so users never reach for sniff_csv/glob","Pre-import spatial files through the upload pipeline instead of st_read in expressions","Log blocklist hits to detect probing attempts early"],"tags":["sql-injection","security","blocklist","duckdb"],"backgroundTag":"dangerous-sql-function-blocked","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}