Tencent/WeKnora · error

invalid source path: %w

Error message

invalid source path: %w

What it means

KS3 copy guard: the source object key was rejected by SafeObjectKey, meaning the key extracted from the ks3:// path is unsafe (path traversal, absolute segments, or invalid characters), so the server-side copy is refused before any KS3 request.

Source

Thrown at internal/application/service/file/ks3.go:196

	if err != nil {
		return "", fmt.Errorf("failed to upload bytes to KS3: %w", err)
	}

	return fmt.Sprintf("%s%s/%s", ks3Scheme, s.bucketName, objectKey), nil
}

// CopyFile copies an existing KS3 object to a new knowledge-owned object using a
// server-side CopyObject (no data leaves KS3). The destination uses the same
// layout as SaveFile. Returns ErrCrossBackendCopy when srcPath is not a ks3:// path.
func (s *ks3FileService) CopyFile(ctx context.Context,
	srcPath string, tenantID uint64, knowledgeID string,
) (string, error) {
	srcBucket, srcKey, err := parseKS3FilePath(srcPath)
	if err != nil {
		return "", fmt.Errorf("ks3 copy rejected source %q: %w", srcPath, ErrCrossBackendCopy)
	}
	if err := utils.SafeObjectKey(srcKey); err != nil {
		return "", fmt.Errorf("invalid source path: %w", err)
	}

	ext := filepath.Ext(srcPath)
	destKey := joinKS3Key(s.pathPrefix, fmt.Sprintf("%d", tenantID), knowledgeID, uuid.New().String()+ext)

	_, err = s.client.CopyObject(&ks3s3.CopyObjectInput{
		Bucket:       ks3aws.String(s.bucketName),
		Key:          ks3aws.String(destKey),
		SourceBucket: ks3aws.String(srcBucket),
		SourceKey:    ks3aws.String(srcKey),
	})
	if err != nil {
		return "", fmt.Errorf("failed to copy file in KS3: %w", err)
	}

	newPath := fmt.Sprintf("%s%s/%s", ks3Scheme, s.bucketName, destKey)
	logger.Infof(ctx, "Copied KS3 object %s to %s", srcPath, newPath)
	return newPath, nil

View on GitHub (pinned to 988cbb0330)

Solutions

1. Sanitize the source object key before calling CopyFile
2. Reject user-supplied keys with traversal patterns at ingestion
3. Log the offending key to trace the malformed input

When it happens

Trigger: Thrown at internal/application/service/file/ks3.go:196 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/140e46ee7731097e. Report an issue: GitHub.