Skip to content

fix: SQLite vector table now respects OM_VECTOR_TABLE env variable #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nullure merged 1 commit into from
Dec 2, 2025
Merged

fix: SQLite vector table now respects OM_VECTOR_TABLE env variable #80

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions backend/src/core/db.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -420,6 +420,8 @@ if (is_pg) {
const dir = path.dirname(db_path);
if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
const db = new sqlite3.Database(db_path);
// SQLite vector table name from env (default: "vectors" for backward compatibility)
const sqlite_vector_table = process.env.OM_VECTOR_TABLE || "vectors";
db.serialize(() => {
db.run("PRAGMA journal_mode=WAL");
db.run("PRAGMA synchronous=NORMAL");
Expand All @@ -434,7 +436,7 @@ if (is_pg) {
`create table if not exists memories(id text primary key,user_id text,segment integer default 0,content text not null,simhash text,primary_sector text not null,tags text,meta text,created_at integer,updated_at integer,last_seen_at integer,salience real,decay_lambda real,version integer default 1,mean_dim integer,mean_vec blob,compressed_vec blob,feedback_score real default 0)`,
);
db.run(
`create table if not exists vectors(id text not null,sector text not null,user_id text,v blob not null,dim integer not null,primary key(id,sector))`,
`create table if not exists ${sqlite_vector_table}(id text not null,sector text not null,user_id text,v blob not null,dim integer not null,primary key(id,sector))`,

Copilot AI Dec 2, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The table name from the environment variable is directly interpolated into the SQL statement without proper escaping or validation. While PostgreSQL uses quoted identifiers (line 92), SQLite does not, potentially allowing SQL injection if OM_VECTOR_TABLE contains malicious input like vectors; DROP TABLE memories--.

Consider either:

  1. Adding validation to ensure the table name contains only safe characters (alphanumeric and underscores)
  2. Using quoted identifiers similar to PostgreSQL: `create table if not exists "${sqlite_vector_table}"(...)`

Example validation:

const sqlite_vector_table = process.env.OM_VECTOR_TABLE || "vectors";
if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(sqlite_vector_table)) {
    throw new Error(`Invalid table name: ${sqlite_vector_table}`);
}

Copilot uses AI. Check for mistakes.
);
db.run(
`create table if not exists waypoints(src_id text,dst_id text not null,user_id text,weight real not null,created_at integer,updated_at integer,primary key(src_id,user_id))`,
Expand Down Expand Up @@ -470,7 +472,7 @@ if (is_pg) {
"create index if not exists idx_memories_user on memories(user_id)",
);
db.run(
"create index if not exists idx_vectors_user on vectors(user_id)",
`create index if not exists idx_vectors_user on ${sqlite_vector_table}(user_id)`,

Copilot AI Dec 2, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The table name from the environment variable is directly interpolated into the SQL statement without proper escaping or validation. This creates the same SQL injection vulnerability as the table creation statement.

Apply the same validation or escaping approach as recommended for the table creation to ensure consistency and security.

Copilot uses AI. Check for mistakes.
);
db.run(
"create index if not exists idx_waypoints_src on waypoints(src_id)",
Expand Down Expand Up @@ -540,9 +542,8 @@ if (is_pg) {
vector_store = new ValkeyVectorStore();
console.log("[DB] Using Valkey VectorStore");
} else {
const vt = process.env.OM_VECTOR_TABLE || "vectors";
vector_store = new PostgresVectorStore({ run_async, get_async, all_async }, vt);
console.log(`[DB] Using SQLite VectorStore with table: ${vt}`);
vector_store = new PostgresVectorStore({ run_async, get_async, all_async }, sqlite_vector_table);
console.log(`[DB] Using SQLite VectorStore with table: ${sqlite_vector_table}`);
}

transaction = {
Expand Down