{"record":{"id":"107e366f9fca7ef3","repo":"siyuan-note/siyuan","slug":"marketplace-package-install-path-already-exists","errorCode":null,"errorMessage":"marketplace package install path already exists","messagePattern":"marketplace package install path already exists","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/bazaar/install.go","lineNumber":135,"sourceCode":"\t// 文件夹的修改时间设置为当前操作时间\n\tif err = os.Chtimes(installPath, now, now); err != nil {\n\t\tlogging.LogWarnf(\"set package [%s] folder mtime failed: %s\", packageName, err)\n\t}\n\n\tgo incPackageDownloads(repoURL, systemID)\n\treturn nil\n}\n\nfunc installPackage(data []byte, installPath, pkgType, packageName string, update bool) (err error) {\n\t// 非更新安装时目标目录已存在且非空则拒绝覆盖，防止把其他包的内容写入已有包目录\n\t// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\n\tif !update {\n\t\tentries, statErr := os.ReadDir(installPath)\n\t\tif statErr != nil && !os.IsNotExist(statErr) {\n\t\t\treturn statErr\n\t\t}\n\t\tif 0 < len(entries) {\n\t\t\treturn errors.New(\"marketplace package install path already exists\")\n\t\t}\n\t}\n\n\ttmpPackage := filepath.Join(util.TempDir, \"bazaar\", \"package\")\n\tif err = os.MkdirAll(tmpPackage, 0755); err != nil {\n\t\treturn\n\t}\n\tname := gulu.Rand.String(7)\n\ttmp := filepath.Join(tmpPackage, name+\".zip\")\n\tdefer os.RemoveAll(tmp)\n\tif err = os.WriteFile(tmp, data, 0644); err != nil {\n\t\treturn\n\t}\n\n\tunzipPath := filepath.Join(tmpPackage, name)\n\tdefer os.RemoveAll(unzipPath)\n\tif err = gulu.Zip.Unzip(tmp, unzipPath); err != nil {\n\t\tlogging.LogErrorf(\"write file [%s] failed: %s\", installPath, err)","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/bazaar/install.go#L117-L153","documentation":"Returned by installPackage (kernel/bazaar/install.go:129-136) during a fresh install (update == false) when the target installPath directory already exists and contains one or more entries. This is a deliberate security guard (GHSA-rpx2-p6hp-x5gj) to prevent a newly downloaded package from silently overwriting files in an already-populated directory, which could be exploited to inject malicious content into an existing package.","triggerScenarios":"Calling InstallPackage with update=false for a package whose install directory (e.g. data/plugins/<name>) already exists and is non-empty.","commonSituations":"Reinstalling a package that was partially uninstalled (directory left behind); package name collision between two different packages; a previous install left residual files; attempting to install over a manually placed package.","solutions":["Uninstall the existing package first via UninstallPackage, then retry the fresh install","If updating an existing package, call InstallPackage with update=true instead of false","Manually remove the install directory if it contains only leftover/empty files","Check for package name collisions — ensure two packages don't share the same install path"],"exampleFix":"// before: fresh install over existing directory\nbazaar.InstallPackage(repoURL, repoHash, installPath, systemID, pkgType, pkgName, false)\n// after: uninstall first, then install\nbazaar.UninstallPackage(installPath)\nbazaar.InstallPackage(repoURL, repoHash, installPath, systemID, pkgType, pkgName, false)","handlingStrategy":"validation","validationCode":"func ensureInstallPathAvailable(installPath string, update bool) error {\n    if update {\n        return nil\n    }\n    entries, err := os.ReadDir(installPath)\n    if err != nil && !os.IsNotExist(err) {\n        return err\n    }\n    if len(entries) > 0 {\n        return fmt.Errorf(\"path %s already exists and is non-empty — uninstall first or use update mode\", installPath)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check whether the install directory is empty before calling InstallPackage with update=false","Uninstall existing packages before attempting a fresh install","Use update=true when upgrading an already-installed package"],"tags":["bazaar","marketplace","install","security","filesystem","go"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}