Code Review: SVY-20666 AI Plugin - Critical fixes required before merge

[Copilot]

Comprehensive review of the AI Plugin implementation for Servoy, which adds vector embeddings and chat capabilities using langchain4j.

Critical Issues (Must Fix)

Resource Management

• PreparedStatement leak in EmbeddingClient.embedAll() line 164 - not closed, causes resource exhaustion
• ExecutorService never shutdown line 48 - prevents graceful application termination
• Files list memory leak in ChatClient line 44 - never cleared between operations

Security

• SQL injection vector in embedAll() - column names (vectorColumn, textColumns) passed unsanitized to query builder
• Beta dependency langchain4j-pgvector:1.7.1-beta14 - production stability concerns

Configuration

• Invalid default model in OpenAiChatBuilder line 35: "gpt-5" doesn't exist, should be "gpt-4-turbo" or "gpt-4"

High Priority Issues

• Missing error handling in ChatClient.getUserMessage() - uncaught exceptions during file processing
• Array bounds validation missing in EmbeddingStore.embed() - metaData/data length mismatch
• Race condition in EmbeddingStore.search() lines 171-180 - non-atomic check-then-wait

Code Quality

• printStackTrace() usage instead of logging framework (multiple locations)
• Typos: repsonse → response, Nighlty → Nightly
• Commented code in ApachePdfBoxDocumentParser line 62
• No unit tests

Example Fix

// Before (resource leak)
PreparedStatement statement = connection.prepareStatement(sql, ...);
try (ResultSet rs = statement.executeQuery()) { ... }

// After
try (PreparedStatement statement = connection.prepareStatement(sql, ...);
     ResultSet rs = statement.executeQuery()) { ... }

Recommendation

Approve with changes required. Well-architected implementation with good documentation, but critical resource management and security issues must be addressed before production deployment.

Estimated fix time: 1-2 days
Risk: MEDIUM-HIGH → LOW after fixes

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• developer.servoy.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.11/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.11/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.11 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.11/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/AIPlugin/AIPlugin org.codehaus.plexus.classworlds.launcher.Launcher clean compile (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

can you review this pull request?

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.