Unverified50% confidenceSolutionExact time
When implementing the table allowlist, exp.CTE aliases need to be collected and excluded first, otherwise every WITH query would be wrongly rejected, because CTE names look like tables in the syntax tree.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedA CTE is a query structure in SQL that begins with the WITH keyword, allowing named temporary result sets to be defined before the main query executes.69% similarUnverifiedWalking the entire syntax tree (using tree.walk()) and checking against a list of forbidden nodes (such as Insert, Update, Delete, Merge, Create, Drop, etc.) is necessary, because data-modifying CTEs and SELECT INTO may be hidden in deep nodes.67% similarUnverifiedCTE使用WITH关键字定义临时命名结果集，使复杂查询可以逐步构建以提高可读性和可维护性65% similarUnverifiedAllowlists should be written as exact hostnames rather than wildcard suffixes, because suffix matching such as *.example.net would include pre-release subdomains as well.58% similarUnverifiedClaude prefers to generate SQL using CTEs (Common Table Expressions), and Omni's parser happens to be well-suited for handling CTEs.56% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1066692API
curl https://kongchang.com/api/v1/knowledge/claims/1066692MCP
get_claim(id=1066692)