{"record":{"id":"2fbf33eb039c42c5","repo":"Tencent/WeKnora","slug":"failed-to-read-script-for-validation-w","errorCode":null,"errorMessage":"failed to read script for validation: %w","messagePattern":"failed to read script for validation: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/manager.go","lineNumber":122,"sourceCode":"\treturn sandbox.Execute(ctx, effective)\n}\n\n// runScriptValidation is the package-level helper that DefaultManager and\n// SessionBoundManager share for pre-execution security checks. Extracting\n// it avoids duplicating the same script/args/stdin validation logic across\n// two Manager implementations while keeping the ScriptValidator private to\n// the manager that owns it.\nfunc runScriptValidation(validator *ScriptValidator, config *ExecuteConfig) error {\n\tif validator == nil || config == nil {\n\t\treturn nil\n\t}\n\n\t// Get script content for validation\n\tscriptContent := config.ScriptContent\n\tif scriptContent == \"\" && config.Script != \"\" {\n\t\tcontent, err := os.ReadFile(config.Script)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read script for validation: %w\", err)\n\t\t}\n\t\tscriptContent = string(content)\n\t}\n\n\t// Validate script content\n\tif scriptContent != \"\" {\n\t\tresult := validator.ValidateScript(scriptContent)\n\t\tif !result.Valid {\n\t\t\tfor _, verr := range result.Errors {\n\t\t\t\tlog.Printf(\"[sandbox] Validation error: %s\", verr.Error())\n\t\t\t}\n\t\t\tif len(result.Errors) > 0 {\n\t\t\t\treturn result.Errors[0]\n\t\t\t}\n\t\t\treturn ErrSecurityViolation\n\t\t}\n\t}\n","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/manager.go#L104-L140","documentation":"runScriptValidation reads the script file from disk when config.ScriptContent is empty and config.Script is set, so security validation can inspect the source. If os.ReadFile fails (missing file, permission denied, path is a directory), the OS error is wrapped as \"failed to read script for validation: %w\" and Execute aborts before running anything.","triggerScenarios":"Calling Execute with a config that leaves ScriptContent empty and sets Script to a path that does not exist, is unreadable (permissions), or is a directory.","commonSituations":"Passing a path relative to a different working directory than the process; container/deployment where the script file was not copied; wrong file permissions after mounting a volume; typo in the script filename; deleting the temp script before Execute runs.","solutions":["Verify the path in config.Script exists and is readable (os.Stat beforehand).","Embed the code directly in config.ScriptContent so no file read is needed.","Fix file permissions or container volume mounts so the process can read the script.","Use an absolute path or resolve relative to the correct working directory."],"exampleFix":"// before\ncfg.Script = \"scripts/run.py\" // file missing\n// after\nif _, err := os.Stat(cfg.Script); err != nil { return err }\ncfg.ScriptContent = string(scriptBytes) // or fix the path/permissions","handlingStrategy":"validation","validationCode":"if cfg.ScriptContent == \"\" && cfg.Script != \"\" {\n    if _, err := os.Stat(cfg.Script); err != nil {\n        return fmt.Errorf(\"script file unreadable: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"res, err := mgr.Execute(ctx, execCfg)\nif err != nil && strings.Contains(err.Error(), \"failed to read script\") {\n    return fmt.Errorf(\"check config.Script path %q: %w\", execCfg.Script, err)\n}","preventionTips":["Prefer passing ScriptContent directly over file paths","Use absolute paths resolved at startup, not relative ones","Stat the script file before Execute in deployment health checks","Ensure container images/volumes actually include the script files"],"tags":["filesystem","validation","io"],"backgroundTag":"file-not-found","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}