nocobase/nocobase · error

SQL statements contain dangerous keywords

Error message

SQL statements contain dangerous keywords

What it means

After confirming the query is a SELECT/WITH, checkSQL scans it case-insensitively for dangerous keywords (e.g. sqlite3_load_extension, load_extension, and other write/DDL keywords in the dangerKeywords list). Substring matching means any occurrence — even inside a string literal, column name, or comment — triggers this error.

Source

Thrown at packages/plugins/@nocobase/plugin-collection-sql/src/server/utils.ts:48

    'pg_stat_activity',
    'information_schema',

    // MySQL
    'LOAD_FILE',
    'BENCHMARK',
    '@@global.',
    '@@session.',

    // SQLite
    'sqlite3_load_extension',
    'load_extension',
  ];
  sql = sql.trim().split(';').shift() || '';
  if (!/^select/i.test(sql) && !/^with([\s\S]+)select([\s\S]+)/i.test(sql)) {
    throw new Error('Only supports SELECT statements or WITH clauses');
  }
  if (dangerKeywords.some((keyword) => sql.toLowerCase().includes(keyword.toLowerCase()))) {
    throw new Error('SQL statements contain dangerous keywords');
  }
};

View on GitHub (pinned to fa42722fef)

Solutions

1. Remove or rename the offending keyword occurrence (alias the column/table, reword string literals).
2. Check the dangerKeywords list in src/server/utils.ts to identify which keyword matched.
3. If a legitimate identifier collides, rename the column/table or use a quoted alias that avoids the banned substring.
4. Perform the write elsewhere — this validator is intentionally strict.

Example fix

// before
const sql = "SELECT * FROM insertions_log"; // contains 'insert'
// after
const sql = "SELECT * FROM event_log WHERE kind = 'insertion'"; // avoid banned substrings

// scan for the same banned substrings before submitting
const DANGEROUS = ['insert','update','delete','drop','alter','create','load_extension','sqlite3_load_extension'];
const hits = DANGEROUS.filter((k) => userSql.toLowerCase().includes(k));
if (hits.length) console.warn('rename offending identifiers/literals:', hits);

try {
  await sqlCollectionRepo.create({ values: { sql: userSql } });
} catch (e) {
  if (e.message === 'SQL statements contain dangerous keywords') {
    // locate and remove/rename the keyword occurrence (aliases, string literals, comments)
  }
}

When it happens

Trigger: A SELECT query whose text contains any danger keyword, e.g. `SELECT * FROM load_extension_log`, a WHERE clause string like `name = 'delete_me'`, or keywords such as INSERT/UPDATE/DROP appearing in aliases or comments.

Common situations: Table or column names coincidentally contain a banned word; query embeds literal strings mentioning those words; developer tries to sneak a write via a CTE.

Related errors

• Only supports SELECT statements or WITH clauses
• SQL cannot be empty
• Invalid aggregation function: ${aggregation}
• Local file path is not allowed
• SQL is empty

AI-assisted analysis of nocobase/nocobase@fa42722fef (2026-09-01). Data as JSON: /api/errors/e06ea3b051e49a07. Report an issue: GitHub.