{"record":{"id":"1eea8107bb52e276","repo":"Tencent/WeKnora","slug":"elasticsearch-address-failed-ssrf-validation-w","errorCode":null,"errorMessage":"elasticsearch address failed SSRF validation: %w","messagePattern":"elasticsearch address failed SSRF validation: %w","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"internal/container/engine_factory.go","lineNumber":193,"sourceCode":"\tcc := store.ConnectionConfig\n\t// Version-based v7/v8 SDK selection.\n\t// Version is auto-detected by PR2's TestConnection and saved to connection_config.\n\t// Empty version defaults to v8 (latest SDK).\n\tif isESv7(cc.Version) {\n\t\treturn createElasticsearchV7Engine(store, cfg)\n\t}\n\treturn createElasticsearchV8Engine(store, cfg)\n}\n\n// isESv7 checks if the detected ES version is 7.x.\nfunc isESv7(version string) bool {\n\treturn strings.HasPrefix(version, \"7.\")\n}\n\nfunc createElasticsearchV8Engine(store types.VectorStore, cfg *config.Config) (interfaces.RetrieveEngineService, error) {\n\tcc := store.ConnectionConfig\n\tif err := utils.ValidateURLForSSRF(cc.Addr); err != nil {\n\t\treturn nil, fmt.Errorf(\"elasticsearch address failed SSRF validation: %w\", err)\n\t}\n\tclient, err := elasticsearch.NewTypedClient(elasticsearch.Config{\n\t\tAddresses: []string{cc.Addr},\n\t\tUsername:  cc.Username,\n\t\tPassword:  cc.Password,\n\t\tTransport: &utils.SSRFValidatingRoundTripper{\n\t\t\tBase: utils.NewSSRFSafeTransport(utils.DefaultSSRFSafeHTTPClientConfig()),\n\t\t},\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create elasticsearch v8 client: %w\", err)\n\t}\n\trepo := elasticsearchRepoV8.NewElasticsearchEngineRepository(client, cfg, &store.IndexConfig)\n\treturn retriever.NewKVHybridRetrieveEngine(repo, types.ElasticsearchRetrieverEngineType), nil\n}\n\nfunc createElasticsearchV7Engine(store types.VectorStore, cfg *config.Config) (interfaces.RetrieveEngineService, error) {\n\tcc := store.ConnectionConfig","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/container/engine_factory.go#L175-L211","documentation":"createElasticsearchV8Engine wraps utils.ValidateURLForSSRF failure on cc.Addr before any client is created. Elasticsearch endpoints pointing at private/loopback/metadata addresses are refused at runtime, even if the stored row was never input-validated.","triggerScenarios":"Thrown at internal/container/engine_factory.go:193 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point the ES address at an allowed, non-SSRF endpoint","Re-save the store through validated create/test flows","Review SSRF policy if the address is legitimately required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}