{"record":{"id":"45acc8c69ba3accf","repo":"Tencent/WeKnora","slug":"object-key-cannot-be-empty","errorCode":null,"errorMessage":"object key cannot be empty","messagePattern":"object key cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":150,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"fileName cannot be empty\")\n\t}\n\tbase := filepath.Base(filepath.Clean(fileName))\n\tif base == \"\" || base == \".\" || base == \"..\" {\n\t\treturn \"\", fmt.Errorf(\"invalid fileName: path traversal or empty name\")\n\t}\n\tif strings.Contains(base, \"..\") {\n\t\treturn \"\", fmt.Errorf(\"invalid fileName: contains path traversal\")\n\t}\n\tif len(base) > 255 {\n\t\treturn \"\", fmt.Errorf(\"fileName too long\")\n\t}\n\treturn base, nil\n}\n\n// SafeObjectKey 校验对象存储的 key（如 COS/MinIO objectName），禁止包含 \"..\" 等路径遍历\nfunc SafeObjectKey(objectKey string) error {\n\tif objectKey == \"\" {\n\t\treturn fmt.Errorf(\"object key cannot be empty\")\n\t}\n\tif strings.Contains(objectKey, \"..\") {\n\t\treturn fmt.Errorf(\"object key contains path traversal\")\n\t}\n\treturn nil\n}\n\n// IsValidURL 验证 URL 是否安全\nfunc IsValidURL(url string) bool {\n\tif url == \"\" {\n\t\treturn false\n\t}\n\n\t// 检查长度\n\tif len(url) > 2048 {\n\t\treturn false\n\t}\n","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L132-L168","documentation":"Input guard in SafeObjectKey (security.go): an empty object-storage key was supplied for a COS/MinIO/S3 operation. GetFile, DeleteFile, CopyFile, GetFileURL, and path parsers all funnel through this check, which also rejects keys containing traversal sequences.","triggerScenarios":"Thrown at internal/utils/security.go:150 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply a non-empty object key built from validated components","Check the upstream record/store for why the key is empty","Never forward empty keys to the object-storage client"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}