{"record":{"id":"0387450a19b3c111","repo":"siyuan-note/siyuan","slug":"encrypted-sy-s-base-id-s-root-id-s","errorCode":null,"errorMessage":"encrypted .sy [%s]: base id [%s] != root id [%s]","messagePattern":"encrypted \\.sy \\[(.+?)\\]: base id \\[(.+?)\\] != root id \\[(.+?)\\]","errorType":"http","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"kernel/filesys/tree.go","lineNumber":572,"sourceCode":"\t\treturn\n\t}\n\n\tif treenode.UpgradeSpec(ret) {\n\t\tneedFix = true\n\t}\n\n\t// v3.5.1 https://github.com/siyuan-note/siyuan/pull/16657 引入的问题，属性值未转义\n\t// v3.5.2 https://github.com/siyuan-note/siyuan/issues/16686 进行了修复，并加了订正逻辑 https://github.com/siyuan-note/siyuan/pull/16712\n\t// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ff66-236v-p4fg XSS 漏洞：\"title\": \"&\\\" onmouseenter=\\\"require('child_process').exec('calc')\"\n\tif escapeAttributeValues(ret) {\n\t\tneedFix = true\n\t}\n\n\tif pathID := util.GetTreeID(p); pathID != ret.Root.ID {\n\t\tif encrypted {\n\t\t\t// 加密 .sy：基名 ID（pathID）必须与解密后的根块 ID 一致。不一致说明密文被替换、\n\t\t\t// 文件名被篡改或 AAD 认证被绕过，不得静默修正——fail-closed，符合加密笔记本威胁模型。\n\t\t\terr = fmt.Errorf(\"encrypted .sy [%s]: base id [%s] != root id [%s]\", p, pathID, ret.Root.ID)\n\t\t\tlogging.LogErrorf(\"%s\", err)\n\t\t\treturn\n\t\t}\n\t\tneedFix = true\n\t\tlogging.LogInfof(\"reset tree id from [%s] to [%s]\", ret.Root.ID, pathID)\n\t\tret.Root.ID = pathID\n\t\tret.ID = pathID\n\t\tret.Root.SetIALAttr(\"id\", ret.ID)\n\t}\n\n\tif !needFix {\n\t\treturn jsonData, false, nil\n\t}\n\n\trenderer := render.NewJSONRenderer(ret, luteEngine.RenderOptions, luteEngine.ParseOptions)\n\tdata = renderer.Render()\n\n\tif !util.UseSingleLineSave {","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/filesys/tree.go#L554-L590","documentation":"Returned by `fixTreeJSONData` on encrypted notebooks when the ID parsed from the filename (`util.GetTreeID(p)`) does not equal the root block ID found inside the decrypted content. SiYuan treats this as a fail-closed integrity violation: a mismatch implies the ciphertext was replaced, the file was renamed, or AAD authentication was bypassed, so it refuses to silently rewrite the ID. Non-encrypted trees auto-fix the mismatch; encrypted trees do not.","triggerScenarios":"Renaming an encrypted `.sy` file outside SiYuan; copying ciphertext from one document into another file; a tampered or corrupted decrypt that produced a different root ID; an AAD-rotation bug. The error fires only when `encrypted == true`.","commonSituations":"Manual file operations inside an encrypted notebook's data dir; a sync conflict resolved by file copy; an attempt to defeat the binding between filename and content in an encrypted box.","solutions":["Do not rename or move encrypted `.sy` files by hand; use SiYuan's own move/rename so IDs stay consistent.","Restore the affected document from an encrypted history snapshot taken before the mismatch.","If the mismatch is from a known migration bug, re-encrypt or re-save the document through the kernel so filename and root ID realign."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// For encrypted trees, verify filename-vs-rootID alignment before deeper processing:\nif pathID := util.GetTreeID(p); encrypted && pathID != tree.Root.ID {\n    return fmt.Errorf(\"encrypted .sy [%s]: base id [%s] != root id [%s]\", p, pathID, tree.Root.ID)\n}","typeGuard":null,"tryCatchPattern":"tree, err := filesys.LoadTree(box, p, lute)\nif err != nil && strings.Contains(err.Error(), \"base id\") {\n    // integrity violation in encrypted box: do NOT auto-fix; restore from encrypted history\n    return err\n}","preventionTips":["Never rename or copy encrypted .sy files outside the kernel.","Resolve sync conflicts via the kernel's merge UI, not by file copy.","Treat this error as a security signal; audit for tampering."],"tags":["security","encryption","integrity","fail-closed","tree"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}