{"record":{"id":"0694573fca2eeefb","repo":"Tencent/WeKnora","slug":"2201","errorCode":"2201","errorMessage":"opensearch: embedding dimension mismatch","messagePattern":"opensearch: embedding dimension mismatch","errorType":"error_code","errorClass":"AppError","httpStatus":400,"severity":"error","filePath":"internal/application/repository/retriever/opensearch/errors.go","lineNumber":20,"sourceCode":"// for OpenSearch k-NN native vector search.\npackage opensearch\n\nimport \"errors\"\n\n// Sentinel errors returned by Repository. The service-layer factory wraps\n// these into typed AppError values (2200/2201) — the repository itself\n// never imports internal/errors. The boundary is intentional (directional\n// dependency).\nvar (\n\t// ErrIndexNotFound — alias / underlying index missing. Search and\n\t// delete-by-query operations return this when the per-dim alias has\n\t// not been created yet (no Save has been issued for that dim).\n\tErrIndexNotFound = errors.New(\"opensearch: index not found\")\n\n\t// ErrDimensionMismatch — embedding dimension violates the per-dim\n\t// invariant (e.g. dim <= 0, dim > 16000, or embeddings within a\n\t// single batch disagree).\n\tErrDimensionMismatch = errors.New(\"opensearch: embedding dimension mismatch\")\n\n\t// ErrAuth — cluster returned 401 / 403. Distinguished from ErrTransport\n\t// so the service layer can map to a clean 4xx instead of 503.\n\tErrAuth = errors.New(\"opensearch: authentication failed\")\n\n\t// ErrTransport — network / 5xx / opaque cluster error. Classified as\n\t// transient: ensureReady does NOT persist this in initErr, so the next\n\t// caller will retry.\n\tErrTransport = errors.New(\"opensearch: transport error\")\n\n\t// ErrVersionUnsupported — cluster is not OpenSearch, is OS 1.x, or is\n\t// OS 2.0~2.3 (pre-Lucene-HNSW-GA). probeVersion enforces.\n\tErrVersionUnsupported = errors.New(\"opensearch: cluster version unsupported\")\n\n\t// ErrConfigInvalid — IndexConfig / storeID / sanitizeIndexName guard\n\t// failed, or the k-NN plugin is missing on one or more cluster nodes.\n\tErrConfigInvalid = errors.New(\"opensearch: invalid index config\")\n","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/repository/retriever/opensearch/errors.go#L2-L38","documentation":"A SubLink node — a subquery nested inside an expression such as `WHERE id IN (SELECT ...)`, `EXISTS (...)`, or a scalar subquery in the target list — was found while checkSubqueries is enabled. Subqueries in expressions can smuggle dangerous functions and nested constructs, so the validator rejects them when subquery checking is on.","triggerScenarios":"Validating `SELECT * FROM users WHERE id IN (SELECT user_id FROM admins)`, `SELECT EXISTS (SELECT 1 FROM x) FROM t`, or `(SELECT max(id) FROM t)` as a scalar expression.","commonSituations":"Common idioms like IN/EXISTS/not-EXISTS correlated filters, scalar lookups in SELECT lists; ORMs that emit subqueries for lazy relations or filtering; queries rewritten to avoid JOINs.","solutions":["Rewrite the subquery as a JOIN: `WHERE id IN (SELECT user_id FROM admins)` becomes an INNER JOIN on admins.user_id (deduplicating if needed).","Replace scalar subqueries in the SELECT list with a LEFT JOIN + aggregate, or compute the value beforehand and pass it as a parameter.","Replace EXISTS anti-join patterns with LEFT JOIN ... IS NULL, or with NOT IN / parameters when the subquery result is small and computed client-side.","If subqueries are legitimately needed from a trusted source, disable checkSubqueries in the validator config."],"exampleFix":"// before\nSELECT * FROM users WHERE id IN (SELECT user_id FROM admins);\n\n// after\nSELECT u.* FROM users u JOIN admins a ON a.user_id = u.id;","handlingStrategy":"validation","validationCode":"var subqInExpr = regexp.MustCompile(`(?i)\\b(in|exists|not\\s+exists)\\s*\\(\\s*select\\b`)\nif subqInExpr.MatchString(sql) {\n\t// rewrite as JOIN or precompute the value before validating\n}","typeGuard":null,"tryCatchPattern":"if err := validator.ValidateQuery(sql); err != nil {\n\tif err.Error() == \"subqueries are not allowed\" {\n\t\treturn fmt.Errorf(\"use JOINs instead of IN/EXISTS subqueries: %w\", err)\n\t}\n}","preventionTips":["Prefer JOINs (including LEFT JOIN ... IS NULL for anti-joins) over IN/EXISTS subqueries.","Precompute scalar lookup values client-side and bind them as parameters.","Check your ORM's generated SQL for subquery-producing relation filters."],"tags":["sql","security","subquery","validation"],"backgroundTag":"subquery-not-allowed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}