microsoft/semantic-kernel · error · VectorStoreOperationException

Access to attribute '{node.attr}' is not allowed in filter e

Error message

Access to attribute '{node.attr}' is not allowed in filter expressions.

What it means

_eval_Attribute first checks the attribute name against _blocked_attributes, a dunder/internal blocklist (e.g. __class__, __globals__, __subclasses__, __code__, __import__). Accessing any blocked attribute raises VectorStoreOperationException. The static parse walk also blocks these names with a more detailed message, so this runtime check is a defense-in-depth net for sandbox-escape attempts that bypass static validation.

Source

Thrown at python/semantic_kernel/connectors/in_memory.py:161

    def _eval_Constant(self, node: ast.Constant, context: Mapping[str, Any]) -> Any:
        """Evaluate a constant literal."""
        del context
        if isinstance(node.value, str) and len(node.value) > self._max_literal_collection_size:
            raise VectorStoreOperationException(
                "String literals in filter expressions exceed the maximum allowed size."
            )
        return node.value

    def _eval_Name(self, node: ast.Name, context: Mapping[str, Any]) -> Any:
        """Evaluate a variable reference."""
        if node.id not in context:
            raise VectorStoreOperationException(f"Use of name '{node.id}' is not allowed in filter expressions.")
        return context[node.id]

    def _eval_Attribute(self, node: ast.Attribute, context: Mapping[str, Any]) -> Any:
        """Evaluate an attribute access."""
        if node.attr in self._blocked_attributes:
            raise VectorStoreOperationException(
                f"Access to attribute '{node.attr}' is not allowed in filter expressions."
            )
        value = self.evaluate(node.value, context)
        try:
            return ReadOnlyAttributeDict._wrap_value(getattr(value, node.attr))
        except AttributeError as e:
            raise VectorStoreOperationException(
                f"Attribute '{node.attr}' is not available in filter expressions."
            ) from e

    def _eval_Subscript(self, node: ast.Subscript, context: Mapping[str, Any]) -> Any:
        """Evaluate an index or slice operation."""
        value = self.evaluate(node.value, context)
        slice_value = self.evaluate(node.slice, context)
        try:
            return ReadOnlyAttributeDict._wrap_value(value[slice_value])
        except Exception as e:
            raise VectorStoreOperationException(f"Error evaluating subscript access: {e}") from e

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Do not reference dunder or internal attributes in filters.
2. Keep blocked_filter_attributes intact (do not remove entries when subclassing).
3. Treat any untrusted filter string as untrusted input; validate/author filters yourself rather than accepting raw user filters.

Example fix

# before
await collection.search(vector=[...], options=VectorSearchOptions(filter=lambda x: x.__class__))  # blocked -> [1310]

# after
await collection.search(vector=[...], options=VectorSearchOptions(filter=lambda x: x.category == 'a'))

import ast

def has_no_blocked_attrs(filter_str: str, blocked: set[str]) -> None:
    for node in ast.walk(ast.parse(filter_str, mode='eval')):
        if isinstance(node, ast.Attribute) and node.attr in blocked:
            raise ValueError(f"filter accesses blocked attribute '{node.attr}'")

from semantic_kernel.exceptions import VectorStoreOperationException
try:
    await collection.search(vector=[...], options=opts)
except VectorStoreOperationException:
    # treat as untrusted input; do not loosen blocked_filter_attributes
    raise

When it happens

Trigger: A filter that reaches the evaluator with an attribute access like x.__class__, x.__globals__, or x.__subclasses__ — normally caught at parse time; fires at eval only if the static blocked-attribute check was relaxed in a subclass.

Common situations: Adversarial or untrusted filter input attempting sandbox escape; subclassing InMemoryCollection and loosening blocked_filter_attributes; security testing of the filter sandbox.

Related errors

• Access to attribute '{node.attr}' is not allowed in filter e
• AST node type '{type(node).__name__}' is not supported durin
• Dictionary unpacking is not allowed in filter expressions.
• Call target node type '{type(node.func).__name__}' is not al
• Filter string must be a lambda expression, e.g. 'lambda x: x

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/931297c83eb06d5b. Report an issue: GitHub.