Add Apache Doris vector store support by jaffrey-deepsource · Pull Request #4 · QuackatronHQ/dify

jaffrey-deepsource · 2026-02-12T17:56:59Z

No description provided.

This commit adds Apache Doris as a new vector database option for Dify's RAG system. Features: - Vector similarity search using cosine distance - Full-text search with BM25 scoring and inverted indexes - Hybrid search combining vector and text search - High-performance bulk data loading via StreamLoad - Connection pooling for efficient resource management - Support for multi-tenant isolation Components added: - DorisVector: Main vector database implementation with cleaned code - DorisConfig: Configuration model with validation - DorisConnectionPool: Thread-safe connection management - DorisVectorFactory: Factory for creating Doris instances - DORIS_SETUP.md: Complete setup guide in English

- Add type annotations to fix mypy errors (pool config dict, params lists) - Add USE database statement in _get_cursor to ensure database context - Add _wait_for_table_normal_state method to wait for schema changes before creating text index (fixes index creation race condition) - Extend Redis lock timeout to accommodate schema change waiting - Update unit tests to account for new USE database statement

deepsource-development · 2026-02-12T18:08:35Z

DeepSource Code Review

DeepSource reviewed changes in the commit range b76c8fa..413534b on this pull request. Below is the summary for the review, and you can see the individual issues we found as review comments.

For detailed review results, please see the PR on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. Please see the DeepSource dashboard for this PR to view those issues.

PR Report Card

Security	× 2 issues	Overall PR Quality Focus Area: Reliability Guidance Address 10 critical 'Unexpected any' type issues across various files to improve type safety. Grade capped at D due to multiple critical issues
Reliability	× 3631 issues
Complexity	× 216 issues
Hygiene	× 748 issues

Code Review Summary

Analyzer	Summary	Details
JavaScript	4590 new issues detected.	Review ↗
Python	8 new issues detected. 1 existing issue fixed.	Review ↗
Secrets	No new issues detected.	Review ↗

How are these analyzer statuses calculated?

Administrators can configure which issue categories are reported and cause analysis to be marked as failed when detected. This helps prevent bad and insecure code from being introduced in the codebase. If you're an administrator, you can modify this in the repository's settings.

💡 If you're a repository administrator, you can configure the quality gates from the settings.

deepsource-development · 2026-02-12T18:26:59Z

+        # Table name format: embedding_ + collection_name
+        # collection_name already includes Vector_index_ prefix and _Node suffix from Dataset.gen_collection_name_by_id
+        self.table_name = f"embedding_{collection_name}"
+        self.index_hash = hashlib.md5(self.table_name.encode()).hexdigest()[:8]


`hashlib.md5` enables collision attacks

The code uses hashlib.md5 to compute a hash of self.table_name, which is cryptographically broken and susceptible to collision attacks. Attackers could generate different inputs that produce the same hash, undermining trust or causing security breaches.

Replace hashlib.md5 with stronger algorithms such as hashlib.sha256 or hashlib.sha512 to ensure cryptographic security and avoid collisions.

deepsource-development · 2026-02-12T18:26:59Z

+        with self._get_cursor() as cur:
+            try:
+                placeholders = ",".join(["%s"] * len(ids))
+                cur.execute(f"DELETE FROM `{self.table_name}` WHERE id IN ({placeholders})", ids)


String-based SQL query construction enables injection attacks

Constructing the SQL DELETE query with f-string interpolation using self.table_name and the placeholders string directly inserts data into the SQL command, exposing the code to SQL injection attacks. An attacker can manipulate self.table_name or ids to execute arbitrary SQL, potentially deleting or corrupting database data.

Use parameterized queries and avoid interpolating untrusted variables directly in SQL command strings. Validate or whitelist self.table_name and pass ids as query parameters to the database adapter to ensure safe escaping and prevent injection.

deepsource-development · 2026-02-12T18:26:59Z

+        assert config.text_search_analyzer == "chinese"
+        assert config.streamload_port == 8030
+
+    def test_invalid_analyzer_raises_error(self):


Instance method without `self` wastes memory and CPU

The method test_invalid_analyzer_raises_error is defined with self as parameter but never uses it, resulting in creation of bound methods for class instances and increased memory and CPU consumption. This overhead persists for every instance where the method is accessed.
Decorate the method with @staticmethod to indicate it does not depend on instance state. This avoids creation of bound methods and reduces memory and computation overhead.

deepsource-development · 2026-02-12T18:26:59Z

+        mock_pool = MagicMock()
+        mock_pool_class.return_value = mock_pool
+
+        pool = DorisConnectionPool(self.config)


Assigned variable `pool` is never used

The variable pool holds a DorisConnectionPool object but is never used after its assignment, which wastes memory and may confuse maintainers about its purpose.

Remove the assignment or rename the variable to _ or _unused to indicate intentional non-use, cleaning up the code and improving readability.

dataroaring and others added 3 commits January 13, 2026 08:41

[autofix.ci] apply automated fixes

413534b

anto-deepsource closed this Feb 12, 2026

anto-deepsource reopened this Feb 12, 2026

anto-deepsource closed this Feb 12, 2026

anto-deepsource reopened this Feb 12, 2026

deepsource-development Bot reviewed Feb 12, 2026

View reviewed changes

jaffrey-deepsource closed this Feb 12, 2026

Navigation Menu

Uh oh!

Add Apache Doris vector store support - #4

Add Apache Doris vector store support #4
jaffrey-deepsource wants to merge 3 commits into
mainfrom
doris_vector

jaffrey-deepsource commented Feb 12, 2026

Uh oh!

deepsource-development Bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

deepsource-development Bot Feb 12, 2026

Uh oh!

deepsource-development Bot Feb 12, 2026

Uh oh!

deepsource-development Bot Feb 12, 2026

Uh oh!

deepsource-development Bot Feb 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jaffrey-deepsource commented Feb 12, 2026

Uh oh!

deepsource-development Bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-development Bot Feb 12, 2026

Choose a reason for hiding this comment

`hashlib.md5` enables collision attacks

Uh oh!

deepsource-development Bot Feb 12, 2026

Choose a reason for hiding this comment

String-based SQL query construction enables injection attacks

Uh oh!

deepsource-development Bot Feb 12, 2026

Choose a reason for hiding this comment

Instance method without `self` wastes memory and CPU

Uh oh!

deepsource-development Bot Feb 12, 2026

Choose a reason for hiding this comment

Assigned variable `pool` is never used

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

deepsource-development Bot commented Feb 12, 2026 •

edited

Loading