{"record":{"id":"a0ed2292eedfc1a2","repo":"Tencent/WeKnora","slug":"vector-store-engine-q-has-no-ssrf-address-policy","errorCode":null,"errorMessage":"vector store engine %q has no SSRF address policy","messagePattern":"vector store engine %q has no SSRF address policy","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"internal/container/engine_factory.go","lineNumber":128,"sourceCode":"\tcase types.ElasticsearchRetrieverEngineType,\n\t\ttypes.OpenSearchRetrieverEngineType,\n\t\ttypes.MilvusRetrieverEngineType,\n\t\ttypes.TencentVectorDBRetrieverEngineType,\n\t\ttypes.DorisRetrieverEngineType:\n\t\treturn check(\"vector store address\", cc.Addr)\n\tcase types.QdrantRetrieverEngineType:\n\t\tendpoint := cc.Host\n\t\tif endpoint != \"\" && cc.Port != 0 {\n\t\t\tendpoint = net.JoinHostPort(strings.Trim(cc.Host, \"[]\"), strconv.Itoa(cc.Port))\n\t\t}\n\t\treturn check(\"qdrant address\", endpoint)\n\tcase types.WeaviateRetrieverEngineType:\n\t\tif err := check(\"weaviate HTTP address\", cc.Host); err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn check(\"weaviate gRPC address\", cc.GrpcAddress)\n\tdefault:\n\t\treturn fmt.Errorf(\"vector store engine %q has no SSRF address policy\", store.EngineType)\n\t}\n}\n\n// createOpenSearchEngine builds an OpenSearch k-NN retrieve engine. Mirrors\n// createElasticsearchV8Engine but uses the driver's TLS-hardened client\n// constructor and injects the audit sink. NewRepository probes the cluster\n// (version + k-NN plugin), so an unreachable cluster fails here at\n// registration rather than on first query.\nfunc createOpenSearchEngine(\n\tctx context.Context, store types.VectorStore, auditSink openSearchRepo.AuditSink,\n) (interfaces.RetrieveEngineService, error) {\n\tclient, err := openSearchRepo.NewOpenSearchClient(&store.ConnectionConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create opensearch client: %w\", err)\n\t}\n\t// Env stores share the cluster without a per-store index prefix; DB stores\n\t// fold their (>=16-char) ID into the index name. NewRepository enforces the\n\t// length rule, so map env-store IDs to \"\".","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/container/engine_factory.go#L110-L146","documentation":"validateRuntimeVectorStoreAddresses default case: the engine type has an SSRF policy for every known network engine, so reaching default means an engine type with network endpoints was added without updating this validator. It is a completeness guard, not a data error.","triggerScenarios":"Thrown at internal/container/engine_factory.go:128 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add an address-policy case for the new engine type in the validator","Verify the engine type is actually network-bound before adding","Fail closed — do not bypass the SSRF check"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}