{"record":{"id":"0034a68100f34685","repo":"larksuite/cli","slug":"s-cannot-stat-resolved-path-q-w","errorCode":null,"errorMessage":"%s: cannot stat resolved path %q: %w","messagePattern":"(.+?): cannot stat resolved path %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/audit.go","lineNumber":110,"sourceCode":"\n// resolveSymlinkIfAllowed resolves a symlink to its target when\n// params.AllowSymlinkPath is true, or rejects it otherwise. When the input\n// is not a symlink, target is returned unchanged. A symlink that points to\n// another symlink is rejected so callers only deal with a single hop.\nfunc resolveSymlinkIfAllowed(target string, linfo fs.FileInfo, params AuditParams) (string, error) {\n\tif linfo.Mode()&os.ModeSymlink == 0 {\n\t\treturn target, nil\n\t}\n\tif !params.AllowSymlinkPath {\n\t\treturn \"\", fmt.Errorf(\"%s: path %q is a symlink (not allowed)\", params.Label, target)\n\t}\n\tresolved, err := vfs.EvalSymlinks(target)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: cannot resolve symlink %q: %w\", params.Label, target, err)\n\t}\n\trinfo, err := vfs.Lstat(resolved)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: cannot stat resolved path %q: %w\", params.Label, resolved, err)\n\t}\n\tif rinfo.Mode()&os.ModeSymlink != 0 {\n\t\treturn \"\", fmt.Errorf(\"%s: resolved path %q is still a symlink\", params.Label, resolved)\n\t}\n\treturn resolved, nil\n}\n\n// requireInTrustedDirs enforces that effectivePath lives under one of the\n// caller-declared trusted directories, if any were declared. An empty\n// trustedDirs list disables the check.\nfunc requireInTrustedDirs(effectivePath string, trustedDirs []string, label string) error {\n\tif len(trustedDirs) == 0 {\n\t\treturn nil\n\t}\n\tcleaned := filepath.Clean(effectivePath)\n\tfor _, dir := range trustedDirs {\n\t\tcleanDir := filepath.Clean(dir)\n\t\tif cleaned == cleanDir || strings.HasPrefix(cleaned, cleanDir+\"/\") {","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit.go#L92-L128","documentation":"After successfully resolving a symlink with EvalSymlinks, resolveSymlinkIfAllowed re-stats the resolved path with vfs.Lstat to verify it exists and is not itself another symlink. If that Lstat fails (typically because the resolution raced with a deletion, or resolution crossed a permission boundary inconsistently), this wrapped error is returned instead of continuing the audit.","triggerScenarios":"AllowSymlinkPath is true, EvalSymlinks succeeds, but vfs.Lstat(resolved) fails: the resolved file was deleted between the two calls, the final directory denies access, or an OS-level error occurs on the resolved path.","commonSituations":"TOCTOU race where a package manager or cleanup job removes the file while the CLI audits it; symlink target inside a directory whose permissions changed mid-run; stale symlink into a now-unmounted filesystem where EvalSymlinks and Lstat disagree.","solutions":["Re-run the command; transient races between EvalSymlinks and Lstat usually disappear on retry","Check the wrapped cause: ENOENT means the symlink target vanished — restore the target file or fix the symlink","Check permissions (ls -ld) on the resolved path's parent directory for the current user","Avoid running audits concurrently with operations that add/remove the target file"],"exampleFix":"// before: audit races with uninstall deleting target\nlark secrets resolve &  apt remove tool &\n// after: run sequentially\napt remove tool && lark secrets resolve","handlingStrategy":"retry","validationCode":"func statStable(p string, attempts int) error {\n  for i := 0; i < attempts; i++ {\n    if _, err := os.Lstat(p); err == nil { return nil }\n    time.Sleep(100 * time.Millisecond)\n  }\n  return fmt.Errorf(\"path %s not stable/stat-able\", p)\n}","typeGuard":null,"tryCatchPattern":"eff, err := binding.AssertSecurePath(params)\nif err != nil {\n  var perr *fs.PathError\n  if errors.As(err, &perr) && errors.Is(perr.Err, syscall.ENOENT) {\n    // target vanished; recreate or retry once\n  }\n  return err\n}","preventionTips":["Do not run audits concurrently with deploys or cleanup jobs that touch the target","Keep symlink targets on stable local filesystems","Re-check the target exists immediately before invoking the CLI"],"tags":["filesystem","symlink","race-condition","security-audit"],"backgroundTag":"symlink-resolution-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}