Tencent/WeKnora · error

baseDir and filePath cannot be empty

Error message

baseDir and filePath cannot be empty

What it means

Input validation in SafePathUnderBase: one of the two arguments — baseDir or filePath — is an empty string, so path containment cannot even be evaluated. Raised before any cleaning/abs computation; callers should treat it as a programming/argument bug rather than a traversal attempt.

Source

Thrown at internal/utils/security.go:111

	if !utf8.ValidString(input) {
		return "", false
	}

	// 检查是否包含潜在的 XSS 攻击
	for _, pattern := range xssPatterns {
		if pattern.MatchString(input) {
			return "", false
		}
	}

	return strings.TrimSpace(input), true
}

// SafePathUnderBase 校验 filePath 是否落在 baseDir 下，防止路径遍历（如 ../../）。
// 返回规范化的绝对路径；若路径逃逸出 baseDir 则返回错误。
func SafePathUnderBase(baseDir, filePath string) (string, error) {
	if baseDir == "" || filePath == "" {
		return "", fmt.Errorf("baseDir and filePath cannot be empty")
	}
	absBase, err := filepath.Abs(filepath.Clean(baseDir))
	if err != nil {
		return "", fmt.Errorf("invalid base dir: %w", err)
	}
	absPath, err := filepath.Abs(filepath.Clean(filePath))
	if err != nil {
		return "", fmt.Errorf("invalid file path: %w", err)
	}
	sep := string(filepath.Separator)
	if absPath != absBase && !strings.HasPrefix(absPath, absBase+sep) {
		return "", fmt.Errorf("path traversal denied: path is outside base directory")
	}
	return absPath, nil
}

// SafeFileName 校验并返回安全的“仅文件名”部分，防止路径遍历。
// 仅保留最后一个路径成分，禁止 ".."、空名或仅含点，用于 SaveBytes 等场景。

View on GitHub (pinned to 988cbb0330)

Solutions

1. Pass a non-empty, configured base directory and file path
2. Check configuration loading if baseDir is unexpectedly empty

When it happens

Trigger: Thrown at internal/utils/security.go:111 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/ad547c10a8ea8b5d. Report an issue: GitHub.