Tencent/WeKnora · error

invalid file path: %w

Error message

invalid file path: %w

What it means

This error is returned by ossFileService.GetFile when utils.SafeObjectKey rejects the object key parsed from filePath. Parsing succeeded (the path is a valid oss:// URL), but the key content is unsafe — typically path traversal or illegal characters. It is a security guard executed before GetObject, protecting against reading unintended objects.

Source

Thrown at internal/application/service/file/oss.go:289

		SourceKey:    oss.Ptr(srcKey),
	})
	if err != nil {
		return "", fmt.Errorf("failed to copy file in OSS: %w", err)
	}

	newPath := fmt.Sprintf("oss://%s/%s", s.bucketName, destKey)
	logger.Infof(ctx, "Copied OSS object %s to %s", srcPath, newPath)
	return newPath, nil
}

// GetFile retrieves a file from OSS by its path.
func (s *ossFileService) GetFile(ctx context.Context, filePath string) (io.ReadCloser, error) {
	bucketName, objectName, err := parseOssFilePath(filePath)
	if err != nil {
		return nil, err
	}
	if err := utils.SafeObjectKey(objectName); err != nil {
		return nil, fmt.Errorf("invalid file path: %w", err)
	}

	var client *oss.Client
	if bucketName == s.tempBucketName && s.tempClient != nil {
		client = s.tempClient
	} else {
		client = s.client
	}

	resp, err := client.GetObject(ctx, &oss.GetObjectRequest{
		Bucket: oss.Ptr(bucketName),
		Key:    oss.Ptr(objectName),
	})
	if err != nil {
		return nil, fmt.Errorf("failed to get file from OSS: %w", err)
	}

	return resp.Body, nil

View on GitHub (pinned to 988cbb0330)

Solutions

1. Reject the request and log the offending path — never attempt to silently sanitize and proceed.
2. Validate keys with utils.SafeObjectKey at write/ingest time so only safe keys are ever stored.
3. Generate object keys server-side (UUID-based, as SaveFile does) instead of accepting client-supplied keys.
4. Scope tenantID into the key prefix and validate it as part of authorization.

Example fix

// before
reader, err := svc.GetFile(ctx, fmt.Sprintf("oss://%s/%s", bucket, userKey))
// after
if err := utils.SafeObjectKey(userKey); err != nil {
    return nil, fmt.Errorf("unsafe object key: %w", err)
}
reader, err := svc.GetFile(ctx, fmt.Sprintf("oss://%s/%s", bucket, userKey))

_, key, err := parseOssFilePath(filePath)
if err != nil { return err }
if err := utils.SafeObjectKey(key); err != nil {
    return fmt.Errorf("unsafe key: %w", err)
}

func isSafeOSSPath(p string) bool {
    _, key, err := parseOssFilePath(p)
    return err == nil && utils.SafeObjectKey(key) == nil
}

reader, err := svc.GetFile(ctx, filePath)
if err != nil {
    if strings.Contains(err.Error(), "invalid file path") {
        return errBadPath // 400-level client error, never retry
    }
    return err
}

When it happens

Trigger: Calling GetFile with an oss:// path whose object key contains traversal sequences (../), leading slashes, or other characters rejected by utils.SafeObjectKey.

Common situations: File paths built from user input in download endpoints; legacy DB records with unnormalized keys; attackers probing for path traversal to read other tenants' objects.

Related errors

• invalid source path: %w
• invalid file path: %w
• invalid file name: %w
• object key contains path traversal
• join request not found

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/eb12f588e79e4a08. Report an issue: GitHub.