{"record":{"id":"95a30811356cc796","repo":"Tencent/WeKnora","slug":"opensearch-authentication-failed","errorCode":null,"errorMessage":"opensearch: authentication failed","messagePattern":"opensearch: authentication failed","errorType":"error_code","errorClass":"AppError","httpStatus":400,"severity":"error","filePath":"internal/application/repository/retriever/opensearch/errors.go","lineNumber":24,"sourceCode":"\n// Sentinel errors returned by Repository. The service-layer factory wraps\n// these into typed AppError values (2200/2201) — the repository itself\n// never imports internal/errors. The boundary is intentional (directional\n// dependency).\nvar (\n\t// ErrIndexNotFound — alias / underlying index missing. Search and\n\t// delete-by-query operations return this when the per-dim alias has\n\t// not been created yet (no Save has been issued for that dim).\n\tErrIndexNotFound = errors.New(\"opensearch: index not found\")\n\n\t// ErrDimensionMismatch — embedding dimension violates the per-dim\n\t// invariant (e.g. dim <= 0, dim > 16000, or embeddings within a\n\t// single batch disagree).\n\tErrDimensionMismatch = errors.New(\"opensearch: embedding dimension mismatch\")\n\n\t// ErrAuth — cluster returned 401 / 403. Distinguished from ErrTransport\n\t// so the service layer can map to a clean 4xx instead of 503.\n\tErrAuth = errors.New(\"opensearch: authentication failed\")\n\n\t// ErrTransport — network / 5xx / opaque cluster error. Classified as\n\t// transient: ensureReady does NOT persist this in initErr, so the next\n\t// caller will retry.\n\tErrTransport = errors.New(\"opensearch: transport error\")\n\n\t// ErrVersionUnsupported — cluster is not OpenSearch, is OS 1.x, or is\n\t// OS 2.0~2.3 (pre-Lucene-HNSW-GA). probeVersion enforces.\n\tErrVersionUnsupported = errors.New(\"opensearch: cluster version unsupported\")\n\n\t// ErrConfigInvalid — IndexConfig / storeID / sanitizeIndexName guard\n\t// failed, or the k-NN plugin is missing on one or more cluster nodes.\n\tErrConfigInvalid = errors.New(\"opensearch: invalid index config\")\n\n\t// ErrFeatureNotEnabled — stubs.go returns this from methods whose real\n\t// implementation has not landed yet (CopyIndices / BatchUpdateChunk* /\n\t// swapToVersion, plus the read/write methods that a follow-up commit\n\t// will replace with production code).","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/repository/retriever/opensearch/errors.go#L6-L42","documentation":"A TypeCast whose target type name starts with `pg_` was found. Types like pg_lsn, pg_node_tree, or any pg_-prefixed system type are internal PostgreSQL representations, and casting to them is a known vector for probing or crashing the server, so the validator blocks them explicitly.","triggerScenarios":"Validating expressions like `col::pg_lsn`, `x::pg_node_tree`, or explicit `CAST(v AS pg_snapshot)` in SELECT/WHERE/ORDER BY clauses.","commonSituations":"Copy-pasted DBA queries that inspect replication or catalog internals; generated queries that force-cast columns to system types; attempts to abuse pg_-prefixed types for exploitation.","solutions":["Remove the cast to the pg_* type and use the column's native type; if a textual form is needed, cast to text instead.","If the target type is a legitimate custom type that happens to be pg_-prefixed, rename it, or adjust the validator's system-type check to an explicit allowlist (trusted input only).","Handle any needed conversion of pg_-typed values (e.g. pg_lsn) in application code after selecting them as text."],"exampleFix":"// before\nSELECT lsn::pg_lsn FROM wal_positions;\n\n// after\nSELECT lsn::text FROM wal_positions;","handlingStrategy":"validation","validationCode":"var pgCast = regexp.MustCompile(`(?i)::\\s*pg_[a-z_]+|cast\\s*\\(\\s*[^)]+\\s+as\\s+pg_[a-z_]+`)\nif pgCast.MatchString(sql) {\n\t// replace with a text cast or native type before validating\n}","typeGuard":null,"tryCatchPattern":"if err := validator.ValidateQuery(sql); err != nil {\n\tif strings.Contains(err.Error(), \"casting to system type\") {\n\t\treturn fmt.Errorf(\"remove pg_* casts; cast to text instead: %w\", err)\n\t}\n}","preventionTips":["Never cast to pg_-prefixed types in application SQL; select such values as text.","Lint queries for `::pg_` and `AS pg_` patterns in CI.","Treat pg_* type casts in user input as probing behavior."],"tags":["sql","security","type-cast","validation"],"backgroundTag":"sql-validation-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}