JAVA.SV.LLM.VECTOR.NOFILTER

Vector retrieval without tenant-scoped filtering

The JAVA.SV.LLM.VECTOR.NOFILTER checker identifies vector or retrieval queries that do not apply tenant-scoped filtering.

Vulnerability and risk

Running a vector or retrieval query without tenant-scoped filtering can let one user access another user's data.

Mitigation and prevention

Apply filters derived from the current principal or tenant before running vector or retrieval queries.

Vulnerable code example

Copy 
import org.springframework.ai.vectorstore.SearchRequest;
import org.springframework.ai.vectorstore.VectorStore;

public class Example {
    private final VectorStore vectorStore;

    public Example(VectorStore vectorStore) {
        this.vectorStore = vectorStore;
    }

    public void search(String query) {
        vectorStore.similaritySearch(
            SearchRequest.query(query)
                .topK(5)); // no tenant-scoped filter
    }
}

Fixed code example

Copy 
import org.springframework.ai.vectorstore.SearchRequest;
import org.springframework.ai.vectorstore.VectorStore;

public class Example {
    private final VectorStore vectorStore;

    public Example(VectorStore vectorStore) {
        this.vectorStore = vectorStore;
    }

    public void search(String query, UserPrincipal principal) {
        vectorStore.similaritySearch(
            SearchRequest.query(query)
                .topK(5)
                .filterExpression("tenantId == '" + principal.getTenantId() + "'"));
    }
}

External guidance

Security training

Application security training materials provided by Secure Code Warrior.