langgenius / langgenius/dify

Relyt and AnalyticDB vector providers generate malformed SQL for metadata-filtered search

Open
#39,476 1 comment 1 reaction 1 assignee Claimed by @AlexMultiAgent View on GitHub
Dominant language
TypeScript
Stars
156k
Forks
24.6k
Avg merge
20h 50m
Merged PRs (30d)
586

Description

## Relyt and AnalyticDB vector providers generate malformed SQL for metadata-filtered search

Two related static defects in the vdb provider packages cause every metadata-filtered vector search on Relyt to fail with a SQL syntax error, and every metadata-filtered vector search on AnalyticDB to fail on PostgreSQL 15+.

### 1. Relyt: doubled-quoted metadata key

**File:** `api/providers/vdb/vdb-relyt/src/dify_vdb_relyt/relyt_vector.py`, lines 258 & 260

```python
conditions = [
f"metadata->>'{key!r}' in ({', '.join(map(repr, value))})"
if len(value) > 1
else f"metadata->>'{key!r}' = {value[0]!r}"
for key, value in filter.items()
]
```

`{key!r}` wraps the key in `'…'`, but the f-string already wraps it in `'…'` for the JSONB operator, so `key="document_id"` renders as:

```sql
metadata->>''document_id'' = ''
```

…which is a syntax error in PostgreSQL/Relyt. Every metadata-filtered search through Relyt breaks.

**Fix:** drop the `!r` so the key is interpolated as a plain identifier:

```python
f"metadata->>'{key}' = {value[0]!r}"
```

The value-side `repr()` is correct and stays; values are UUIDs or system-controlled strings, so `repr()` quoting is sufficient.

### 2. AnalyticDB: missing space between `WHERE 1=1` and `AND …`

**File:** `api/providers/vdb/vdb-analyticdb/src/dify_vdb_analyticdb/analyticdb_vector_sql.py`, line 215

```python
where_clause = "WHERE 1=1"
if document_ids_filter:
document_ids = ", ".join(f"'{id}'" for id in document_ids_filter)
where_clause += f"AND metadata_->>'document_id' IN ({document_ids})"
```

Concatenation yields:

```sql
WHERE 1=1AND metadata_->>'document_id' IN (...)
```

Older PostgreSQL versions tolerate this; PostgreSQL 15+ (and current AnalyticDB builds) reject `1AND` as a malformed numeric literal: "trailing junk after numeric literal". Every filtered vector search on a current AnalyticDB backend fails.

**Fix:** add a trailing space:

```python
where_clause = "WHERE 1=1 "
```

### Notes

- Both defects are verifiable by reading the file; I have not run live Relyt/AnalyticDB backends.
- No user-controlled quotes currently reach the SQL paths in either provider, so this issue is a functional defect (broken filtered search) rather than a security vulnerability. Other vdb providers (Hologres, OceanBase) use parameterized queries; Relyt and AnalyticDB stand out as the last two using string interpolation for filter construction.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.