{"record":{"id":"1feb33cf427f4f48","repo":"apache/shardingsphere","slug":"can-not-use-different-encryptor-for-s-and-s-in","errorCode":null,"errorMessage":"Can not use different encryptor for %s and %s in %s","messagePattern":"Can not use different encryptor for (.+?) and (.+?) in (.+?)","errorType":"exception","errorClass":"UnsupportedSQLOperationException","httpStatus":null,"severity":"error","filePath":"features/encrypt/core/src/main/java/org/apache/shardingsphere/encrypt/checker/cryptographic/SubqueryNestedInBinaryOperationEncryptorChecker.java","lineNumber":143,"sourceCode":"        return projection instanceof ColumnProjectionSegment\n                ? ((ColumnProjectionSegment) projection).getColumn().getColumnBoundInfo()\n                : new ColumnSegmentBoundInfo(new IdentifierValue(projection.getColumnLabel()));\n    }\n    \n    private static boolean isNotColumnAndSubquery(final ExpressionSegment expression) {\n        return !(expression instanceof ColumnSegment) && !(expression instanceof RowExpression) && !isSubquerySegment(expression);\n    }\n    \n    private static boolean isSubquerySegment(final ExpressionSegment expression) {\n        return expression instanceof SubqueryExpressionSegment || expression instanceof SubquerySegment || expression instanceof QuantifySubqueryExpression;\n    }\n    \n    private static void checkEncryptorIsSame(final ColumnSegmentBoundInfo leftColumnInfo, final ColumnSegmentBoundInfo rightColumnInfo, final EncryptRule encryptRule, final String scenario) {\n        if (EncryptorComparator.isEquivalentFilterSame(encryptRule, leftColumnInfo, rightColumnInfo)) {\n            return;\n        }\n        String reason = \"Can not use different encryptor for \" + leftColumnInfo + \" and \" + rightColumnInfo + \" in \" + scenario;\n        throw new UnsupportedSQLOperationException(reason);\n    }\n}\n","sourceCodeStart":125,"sourceCodeEnd":146,"githubUrl":"https://github.com/apache/shardingsphere/blob/e952770a215630a3659c75d64369168cd3e26b82/features/encrypt/core/src/main/java/org/apache/shardingsphere/encrypt/checker/cryptographic/SubqueryNestedInBinaryOperationEncryptorChecker.java#L125-L146","documentation":"checkEncryptorIsSame in SubqueryNestedInBinaryOperationEncryptorChecker requires that two compared columns (e.g. a row-expression column from the outer query and a projection column from a nested subquery) use equivalent encryptor configurations. EncryptorComparator.isEquivalentFilterSame returning false throws UnsupportedSQLOperationException naming both ColumnSegmentBoundInfos and the scenario.","triggerScenarios":"SQL such as WHERE (t1.col_a) = (SELECT t2.col_b ...) where col_a uses one encrypt algorithm/key and col_b uses a different one (or one is encrypted and the other is not, or assisted-query configurations differ), on a rule set that enables this checker.","commonSituations":"Columns with the same name in different tables configured with different encryptors; key rotation applied to one table only; adding encryption to one side of an existing join/subquery comparison; differing assisted-query (like-query) setups between the pair.","solutions":["Align the encryptor type, key and assisted/like-query configuration for both compared columns in encrypt rules","Make both sides plain (unencrypted) if encryption is not required for the comparison","Restructure the SQL to compare in application code instead of across mismatched encrypted columns","After aligning, verify with a simple equality query before re-running the original row/subquery SQL"],"exampleFix":"# before\ntables:\n  t1: {columns: {a: {encryptor: {name: AES, props: {aes-key-value: k1}}}}}\n  t2: {columns: {b: {encryptor: {name: AES, props: {aes-key-value: k2}}}}}\n# after (same key for compared columns)\n  t2: {columns: {b: {encryptor: {name: AES, props: {aes-key-value: k1}}}}}","handlingStrategy":"validation","validationCode":"void checkPair(RuleColumn a, RuleColumn b) { if (!a.encryptorType.equals(b.encryptorType) || !Objects.equals(a.key, b.key)) throw new ConfigException(\"encryptors differ: \" + a + \" vs \" + b); }","typeGuard":null,"tryCatchPattern":"catch (UnsupportedSQLOperationException e) { if (e.getMessage().startsWith(\"Can not use different encryptor\")) { /* fix rule config, no retry until aligned */ } }","preventionTips":["Keep compared columns' encryptor type and key identical","Rotate keys on both sides of a comparison together","Add a config lint that verifies encryptor symmetry for join/subquery column pairs"],"tags":["encrypt","sql-checker","encryptor-mismatch","subquery"],"backgroundTag":null,"analyzedSha":"e952770a215630a3659c75d64369168cd3e26b82","analyzedAt":"2026-08-14T13:54:53.392Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}