{"record":{"id":"55aa3333a4cbc0ad","repo":"Tencent/WeKnora","slug":"s-failed-ssrf-validation-w-55aa33","errorCode":null,"errorMessage":"%s failed SSRF validation: %w","messagePattern":"(.+?) failed SSRF validation: %w","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"internal/container/engine_factory.go","lineNumber":102,"sourceCode":"\t\treturn createOpenSearchEngine(ctx, store, auditSink)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported engine type: %s\", store.EngineType)\n\t}\n}\n\n// validateRuntimeVectorStoreAddresses is the final guard for persisted or\n// imported vector-store rows. Create/test handlers validate the same fields at\n// the input boundary, but runtime construction must not assume every stored row\n// was written through those handlers.\nfunc validateRuntimeVectorStoreAddresses(store types.VectorStore) error {\n\tcc := store.ConnectionConfig\n\tcheck := func(label, endpoint string) error {\n\t\tendpoint = strings.TrimSpace(endpoint)\n\t\tif endpoint == \"\" {\n\t\t\treturn nil\n\t\t}\n\t\tif err := utils.ValidateURLForSSRF(endpoint); err != nil {\n\t\t\treturn fmt.Errorf(\"%s failed SSRF validation: %w\", label, err)\n\t\t}\n\t\treturn nil\n\t}\n\n\tswitch store.EngineType {\n\tcase types.PostgresRetrieverEngineType, types.SQLiteRetrieverEngineType:\n\t\treturn nil\n\tcase types.ElasticsearchRetrieverEngineType,\n\t\ttypes.OpenSearchRetrieverEngineType,\n\t\ttypes.MilvusRetrieverEngineType,\n\t\ttypes.TencentVectorDBRetrieverEngineType,\n\t\ttypes.DorisRetrieverEngineType:\n\t\treturn check(\"vector store address\", cc.Addr)\n\tcase types.QdrantRetrieverEngineType:\n\t\tendpoint := cc.Host\n\t\tif endpoint != \"\" && cc.Port != 0 {\n\t\t\tendpoint = net.JoinHostPort(strings.Trim(cc.Host, \"[]\"), strconv.Itoa(cc.Port))\n\t\t}","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/container/engine_factory.go#L84-L120","documentation":"validateRuntimeVectorStoreAddresses wraps utils.ValidateURLForSSRF failure for a stored vector-store endpoint. Runtime construction re-validates persisted rows because create/test handlers can't guarantee every row passed input validation — SSRF-unsafe addresses (private/link-local/metadata targets) are refused before any client is built.","triggerScenarios":"Thrown at internal/container/engine_factory.go:102 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the store's connection address to a public/allowed endpoint","Re-save the store through the validating create/test handlers","Check SSRF allowlist policy if the address is legitimately internal"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}