Skip to content

BedrockEmbedder::embed doesn't validate response vector length #15

Closed

Description

@jjbaumert

Summary: crates/embeddings/src/bedrock.rs::BedrockEmbedder::embed requests embeddings at self.dimensions but never checks that the returned vector's length actually matches self.dimensions before returning it. A mismatched (or empty) embedding — e.g. from a Bedrock model/version change, a partial response, or an API contract drift — propagates silently through the embedding pipeline and only fails later, at the Qdrant upsert step, with an error that doesn't point back to the actual cause.

Severity: S4 — latent/internal. This requires an external anomaly (Bedrock returning a vector of the wrong length) to manifest at all; it's not something a normal user or normal document triggers. The value of fixing it is fail-fast diagnostics, not preventing a currently-observed failure.

Environment:

  • Deploy: any (dependent on Bedrock API behavior, not reproducible purely locally without mocking a malformed response)
  • Commit: 6411ddb

Repro steps:

  1. Mock/stub the Bedrock embeddings endpoint to return a vector shorter or longer than the configured dimensions (the existing test scaffolding for this module already mocks the HTTP layer — see embed_missing_embedding_field_maps_to_serialization_error and neighboring tests, crates/embeddings/src/bedrock.rs:153-183, as a pattern to extend).
  2. Call BedrockEmbedder::embed(text).
  3. Observe the mismatched-length vector is returned as Ok(...) with no validation error.

Expected: embed should reject a response whose vector length doesn't match self.dimensions, returning a clear EmbeddingError naming the mismatch, rather than propagating a bad vector downstream.

Observed: No length check exists between parsing the response and returning it (crates/embeddings/src/bedrock.rs:24-ish, embed); a length mismatch would only surface later at the Qdrant upsert boundary, with an error message that doesn't identify Bedrock as the source.

Evidence:

  • Code: crates/embeddings/src/bedrock.rs:24-68-ish (embed), no comparison of the parsed vector's length against self.dimensions (set at construction, crates/embeddings/src/bedrock.rs:12-20).
  • Existing tests (crates/embeddings/src/bedrock.rs:124- onward) cover missing-field, non-numeric, non-JSON, and service-error responses, but not a well-formed response with the wrong vector length.

Suspected area: crates/embeddings/src/bedrock.rs::BedrockEmbedder::embed — add a length check against self.dimensions immediately after parsing, returning a dedicated EmbeddingError variant.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingverification-findingFinding from a verification run

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions