{"record":{"id":"488f7ef6c0e68192","repo":"larksuite/cli","slug":"unsafe-s-q-w","errorCode":null,"errorMessage":"unsafe %s %q: %w","messagePattern":"unsafe (.+?) %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/tls_ca.go","lineNumber":35,"sourceCode":")\n\n// applyExtraRootCA augments t with an additional PEM bundle used for configured proxy\n// TLS interception.\nfunc applyExtraRootCA(t *http.Transport, caPath string) error {\n\tcaPath = strings.TrimSpace(caPath)\n\tif caPath == \"\" {\n\t\treturn nil\n\t}\n\tif !filepath.IsAbs(caPath) {\n\t\treturn fmt.Errorf(\"invalid %s %q: must be an absolute path to a PEM file\", envvars.CliCAPath, caPath)\n\t}\n\tsafeCAPath, err := binding.AssertSecurePath(binding.AuditParams{\n\t\tTargetPath:            caPath,\n\t\tLabel:                 envvars.CliCAPath,\n\t\tAllowReadableByOthers: true,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unsafe %s %q: %w\", envvars.CliCAPath, caPath, err)\n\t}\n\tpemBytes, err := vfs.ReadFile(safeCAPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to read %s %q: %w\", envvars.CliCAPath, caPath, err)\n\t}\n\n\t// Augment the system trust store. Do NOT silently discard a SystemCertPool\n\t// error: falling back to an empty pool would make this transport trust ONLY\n\t// the extra CA (dropping all system roots), which narrows trust unexpectedly\n\t// and could break TLS to legitimate endpoints. Fail closed instead.\n\tpool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load system cert pool for %s: %w\", envvars.CliCAPath, err)\n\t}\n\tif pool == nil {\n\t\tpool = x509.NewCertPool()\n\t}\n\tif ok := pool.AppendCertsFromPEM(pemBytes); !ok {","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/tls_ca.go#L17-L53","documentation":"The extra root CA file (CLI_CA_PATH) passed binding.AssertSecurePath: it is absolute but unsafe — e.g. permissions too open in the wrong direction, symlink issues, or located in a disallowed location. The CLI wraps the underlying security-audit error with 'unsafe %s %q: %w' and refuses to load the CA.","triggerScenarios":"CLI_CA_PATH points to a file that fails AssertSecurePath — symlinked path, path under a world-writable directory, or other policy violation — while AllowReadableByOthers is requested; raised in ApplyToTransport -> applyExtraRootCA.","commonSituations":"CA bundle placed in /tmp or another shared directory; symlink chains created for convenience; hardened environments where file ownership is root but the CLI runs unprivileged.","solutions":["Inspect the wrapped cause (%w) to see which security check failed.","Move the CA file to a dedicated root-owned directory such as /etc/lark-cli/ with 0644 perms and no symlinks.","Re-run with the new absolute path in CLI_CA_PATH."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"fi, err := os.Lstat(caPath)\nif err != nil || fi.Mode()&os.ModeSymlink != 0 {\n\treturn fmt.Errorf(\"CA path must be a regular, non-symlinked file\")\n}","typeGuard":null,"tryCatchPattern":"if err := applyExtraRootCA(tr, caPath); err != nil {\n\tvar secErr *binding.SecurityError\n\tif errors.As(err, &secErr) {\n\t\tlog.Fatalf(\"CA path rejected by security policy: %v\", secErr)\n\t}\n\treturn err\n}","preventionTips":["Keep the CA file in a root-owned directory with no symlinks.","Check the wrapped cause for which security rule tripped.","Provision the file with install -m 0644 from a trusted source."],"tags":["tls","security","path-validation","certificate"],"backgroundTag":"unsafe-file-path","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}