Tencent/WeKnora · error

invalid file path: %w

Error message

invalid file path: %w

What it means

Path validation in SafePathUnderBase: filepath.Abs/Clean could not normalize the user-supplied filePath (e.g., it is not a usable path on this OS). The %w wraps the filepath error; it fires during sanitization before the escape check, catching malformed paths rather than traversal attempts (which get the explicit 'path traversal denied' error).

Source

Thrown at internal/utils/security.go:119

		}
	}

	return strings.TrimSpace(input), true
}

// SafePathUnderBase 校验 filePath 是否落在 baseDir 下，防止路径遍历（如 ../../）。
// 返回规范化的绝对路径；若路径逃逸出 baseDir 则返回错误。
func SafePathUnderBase(baseDir, filePath string) (string, error) {
	if baseDir == "" || filePath == "" {
		return "", fmt.Errorf("baseDir and filePath cannot be empty")
	}
	absBase, err := filepath.Abs(filepath.Clean(baseDir))
	if err != nil {
		return "", fmt.Errorf("invalid base dir: %w", err)
	}
	absPath, err := filepath.Abs(filepath.Clean(filePath))
	if err != nil {
		return "", fmt.Errorf("invalid file path: %w", err)
	}
	sep := string(filepath.Separator)
	if absPath != absBase && !strings.HasPrefix(absPath, absBase+sep) {
		return "", fmt.Errorf("path traversal denied: path is outside base directory")
	}
	return absPath, nil
}

// SafeFileName 校验并返回安全的“仅文件名”部分，防止路径遍历。
// 仅保留最后一个路径成分，禁止 ".."、空名或仅含点，用于 SaveBytes 等场景。
func SafeFileName(fileName string) (string, error) {
	if fileName == "" {
		return "", fmt.Errorf("fileName cannot be empty")
	}
	base := filepath.Base(filepath.Clean(fileName))
	if base == "" || base == "." || base == ".." {
		return "", fmt.Errorf("invalid fileName: path traversal or empty name")
	}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Inspect the wrapped filepath.Abs error
2. Correct the malformed filePath before retrying

When it happens

Trigger: Thrown at internal/utils/security.go:119 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/48a29623e9966623. Report an issue: GitHub.