{"record":{"id":"44f3d8b7401bb372","repo":"siyuan-note/siyuan","slug":"w-selected-vault-path-is-sensitive","errorCode":null,"errorMessage":"%w: selected Vault path is sensitive","messagePattern":"%w: selected Vault path is sensitive","errorType":"error_code","errorClass":"errObsidianVaultUnsafePath","httpStatus":null,"severity":"error","filePath":"kernel/model/import_obsidian.go","lineNumber":577,"sourceCode":"\tif strings.TrimSpace(localPath) == \"\" {\n\t\treturn \"\", fmt.Errorf(\"%w: path is empty\", errObsidianVaultUnreadable)\n\t}\n\tabs, err := filepath.Abs(filepath.Clean(localPath))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%w: normalize Vault path: %v\", errObsidianVaultUnreadable, err)\n\t}\n\tinfo, err := os.Lstat(abs)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%w: read Vault root: %v\", errObsidianVaultUnreadable, err)\n\t}\n\tif !info.IsDir() {\n\t\treturn \"\", errObsidianVaultNotDirectory\n\t}\n\tif info.Mode()&os.ModeSymlink != 0 || isObsidianResolvedLink(abs) {\n\t\treturn \"\", fmt.Errorf(\"%w: Vault root is a symbolic link or reparse point\", errObsidianVaultUnsafePath)\n\t}\n\tif util.IsSensitivePath(abs) {\n\t\treturn \"\", fmt.Errorf(\"%w: selected Vault path is sensitive\", errObsidianVaultUnsafePath)\n\t}\n\tworkspace, _ := filepath.Abs(filepath.Clean(util.WorkspaceDir))\n\tif sameObsidianPath(abs, workspace) || gulu.File.IsSubPath(workspace, abs) || gulu.File.IsSubPath(abs, workspace) {\n\t\treturn \"\", fmt.Errorf(\"%w: Vault root and SiYuan workspace contain each other\", errObsidianVaultUnsafePath)\n\t}\n\tconfigPath := filepath.Join(abs, \".obsidian\")\n\tconfigInfo, statErr := os.Lstat(configPath)\n\tif statErr != nil {\n\t\tif os.IsNotExist(statErr) {\n\t\t\treturn \"\", errObsidianVaultConfigMissing\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"%w: read Vault config directory: %v\", errObsidianVaultUnreadable, statErr)\n\t}\n\tif !configInfo.IsDir() || configInfo.Mode()&os.ModeSymlink != 0 || isObsidianResolvedLink(configPath) {\n\t\treturn \"\", errObsidianVaultConfigMissing\n\t}\n\treturn abs, nil\n}","sourceCodeStart":559,"sourceCodeEnd":595,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/8641553a1f07374001902d3ce773285db1292b2d/kernel/model/import_obsidian.go#L559-L595","documentation":"Security guard: util.IsSensitivePath flagged the chosen vault path as sensitive (e.g. it overlaps OS/system directories, the SiYuan installation, or similar protected locations). The kernel wraps errObsidianVaultUnsafePath with 'selected Vault path is sensitive' to prevent destructive imports into critical directories.","triggerScenarios":"validateObsidianVaultRoot at kernel/model/import_obsidian.go:577 when the selected vault path matches util.IsSensitivePath — e.g. the workspace dir, kernel binary location, home-level system folders, or other protected paths.","commonSituations":"User picks the SiYuan data folder itself as the vault; vault placed inside the application install directory; automation pointing at system directories like /etc or C:\\Windows.","solutions":["Choose a vault directory outside all sensitive/system locations (a plain Documents folder is fine)","Do not select the SiYuan workspace, installation directory, or OS system folders as the vault","Move the vault to a neutral location if it currently lives in a protected directory","Review util.IsSensitivePath rules to understand which prefixes are rejected"],"exampleFix":"// before\nanalyzeObsidianVault(workspaceDir + \"/vault\") // inside workspace\n// after\nanalyzeObsidianVault(\"/Users/me/Documents/obsidian-vault\")","handlingStrategy":"validation","validationCode":"abs, _ := filepath.Abs(vaultPath)\nif util.IsSensitivePath(abs) {\n    return errors.New(\"choose a vault outside protected/system directories\")\n}","typeGuard":"null","tryCatchPattern":"_, err := AnalyzeObsidianVault(vaultPath)\nif err != nil && strings.Contains(err.Error(), \"path is sensitive\") {\n    promptUserToChooseAnotherFolder()\n}","preventionTips":["Store vaults in neutral user directories (Documents, etc.)","Never point imports at the SiYuan workspace or install directory","Review IsSensitivePath rules when automating vault selection"],"tags":["obsidian-import","path-safety","security","sensitive-path"],"backgroundTag":"path-traversal-blocked","analyzedSha":"8641553a1f07374001902d3ce773285db1292b2d","analyzedAt":"2026-09-11T16:08:28.414Z","contentChangedAt":"2026-09-11T16:08:28.414Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}