Tencent/WeKnora · error

%s failed SSRF validation: %w

Error message

%s failed SSRF validation: %w

What it means

validateRuntimeVectorStoreAddresses wraps utils.ValidateURLForSSRF failure for a stored vector-store endpoint. Runtime construction re-validates persisted rows because create/test handlers can't guarantee every row passed input validation — SSRF-unsafe addresses (private/link-local/metadata targets) are refused before any client is built.

Source

Thrown at internal/container/engine_factory.go:102

		return createOpenSearchEngine(ctx, store, auditSink)
	default:
		return nil, fmt.Errorf("unsupported engine type: %s", store.EngineType)
	}
}

// validateRuntimeVectorStoreAddresses is the final guard for persisted or
// imported vector-store rows. Create/test handlers validate the same fields at
// the input boundary, but runtime construction must not assume every stored row
// was written through those handlers.
func validateRuntimeVectorStoreAddresses(store types.VectorStore) error {
	cc := store.ConnectionConfig
	check := func(label, endpoint string) error {
		endpoint = strings.TrimSpace(endpoint)
		if endpoint == "" {
			return nil
		}
		if err := utils.ValidateURLForSSRF(endpoint); err != nil {
			return fmt.Errorf("%s failed SSRF validation: %w", label, err)
		}
		return nil
	}

	switch store.EngineType {
	case types.PostgresRetrieverEngineType, types.SQLiteRetrieverEngineType:
		return nil
	case types.ElasticsearchRetrieverEngineType,
		types.OpenSearchRetrieverEngineType,
		types.MilvusRetrieverEngineType,
		types.TencentVectorDBRetrieverEngineType,
		types.DorisRetrieverEngineType:
		return check("vector store address", cc.Addr)
	case types.QdrantRetrieverEngineType:
		endpoint := cc.Host
		if endpoint != "" && cc.Port != 0 {
			endpoint = net.JoinHostPort(strings.Trim(cc.Host, "[]"), strconv.Itoa(cc.Port))
		}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Fix the store's connection address to a public/allowed endpoint
2. Re-save the store through the validating create/test handlers
3. Check SSRF allowlist policy if the address is legitimately internal

When it happens

Trigger: Thrown at internal/container/engine_factory.go:102 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/55aa3333a4cbc0ad. Report an issue: GitHub.