chroma
chroma copied to clipboard
chroma-core
"Parser Error: syntax error at or near" when a string contains apostrophe
When where_document contains a string with an apostrophe, I get Parser Error: syntax error at or near For example, for the string "company's", I get:
Parser Error: syntax error at or near "s"
LINE 1: ...M embeddings WHERE position('company's' in document) > 0 AND collection_uuid...
The problem is in duckdb.py at line 232:
val = self._conn.execute(
f"""SELECT {",".join(select_columns)} FROM embeddings {where}"""
).fetchall()
Apparently, the DB query contains an unescaped apostrophe which breaks it. I was trying to escape the apostrophe, but it didn't work.
@tezer this should definitely be handled more elegantly.
as a workaround, i wonder if doing html encoding, eg %27 for ' would solve the issue?
Yes, the problem is gone, but nothing is found. The same achieved by simply deleting the apostrophe: it fails to match the string during DB look up.
The problem, I think, roots in how the where string is composed. It simply concatenated from the user input and SQL commands and then is passed to the query.
It is also constituting a SQL injection vulnerability when a user can pass through a malicious command with their query. You should use SQL parameters for queries to avoid this.
I agree, we should fix how this is handled. We will look into it - thanks for flagging.
