{"record":{"id":"2145ea0cfb002ace","repo":"larksuite/cli","slug":"s-must-not-be-empty","errorCode":null,"errorMessage":"%s must not be empty","messagePattern":"(.+?) must not be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/validate/resource.go","lineNumber":29,"sourceCode":"\n\t\"github.com/larksuite/cli/internal/charcheck\"\n)\n\n// unsafeResourceChars matches URL-special characters, control characters,\n// and percent signs (to prevent %2e%2e encoding bypass).\nvar unsafeResourceChars = regexp.MustCompile(`[?#%\\x00-\\x1f\\x7f]`)\n\n// ResourceName validates an API resource identifier (messageId, fileToken, etc.)\n// before it is interpolated into a URL path via fmt.Sprintf. It rejects path\n// traversal (..), URL metacharacters (?#%), percent-encoded bypasses (%2e%2e),\n// control characters, and dangerous Unicode.\n//\n// Without this check, an input like \"../admin\" or \"?evil=true\" in a message ID\n// would alter the API endpoint the request is sent to. Works alongside\n// EncodePathSegment for defense-in-depth.\nfunc ResourceName(name, flagName string) error {\n\tif name == \"\" {\n\t\treturn fmt.Errorf(\"%s must not be empty\", flagName)\n\t}\n\tfor _, seg := range strings.Split(name, \"/\") {\n\t\tif seg == \"..\" {\n\t\t\treturn fmt.Errorf(\"%s must not contain '..' path traversal\", flagName)\n\t\t}\n\t}\n\tif unsafeResourceChars.MatchString(name) {\n\t\treturn fmt.Errorf(\"%s contains invalid characters\", flagName)\n\t}\n\tfor _, r := range name {\n\t\tif charcheck.IsDangerousUnicode(r) {\n\t\t\treturn fmt.Errorf(\"%s contains dangerous Unicode characters\", flagName)\n\t\t}\n\t}\n\treturn nil\n}\n\n// EncodePathSegment percent-encodes user input for safe use as a single URL path","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/validate/resource.go#L11-L47","documentation":"ResourceName validates a caller-supplied resource identifier (message IDs, app IDs, etc.) used in URL paths. An empty value cannot form a valid endpoint, so it is rejected with the flag name embedded for clarity. This is the first of several defenses that keep user input from altering the API endpoint.","triggerScenarios":"validate.ResourceName called with name == \"\" from buildServiceRequest, SetHelper/UnsetHelper, validateMemberAppID, or anonymous call sites — typically when a required ID flag is unset or expands to an empty value.","commonSituations":"Forgetting a required --message-id/--app-id flag, environment variables that expand to empty strings, upstream command output that produced no ID, scripting pipelines where a lookup returned nothing.","solutions":["Supply the required ID flag explicitly.","Verify the variable or env var feeding the flag is actually populated before invoking the command.","Check earlier pipeline steps that should have produced the ID and failed silently.","Run the command with --help to confirm the exact flag name shown in the error."],"exampleFix":"// before\nlark-cli im message get --message-id \"$MSG_ID\"   # MSG_ID empty\n// after\n: \"${MSG_ID:?MSG_ID must be set}\"\nlark-cli im message get --message-id \"$MSG_ID\"","handlingStrategy":"validation","validationCode":"if id == \"\" {\n    return fmt.Errorf(\"--message-id is required\")\n}","typeGuard":null,"tryCatchPattern":"if err := cmd.Run(); err != nil {\n    if strings.Contains(err.Error(), \"must not be empty\") {\n        return fmt.Errorf(\"supply the required resource ID: %w\", err)\n    }\n    return err\n}","preventionTips":["Check --help for required ID flags before scripting.","Fail fast in scripts with : \"${ID:?}\" when IDs come from env vars.","Verify upstream lookups actually returned an ID before chaining commands.","Use dry-run mode to surface validation errors without API calls."],"tags":["input-validation","missing-argument","cli-flags"],"backgroundTag":"missing-required-argument","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}