{"record":{"id":"4a359c657c6c14e5","repo":"siyuan-note/siyuan","slug":"invalid-marketplace-package-type","errorCode":null,"errorMessage":"invalid marketplace package type","messagePattern":"invalid marketplace package type","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/bazaar/install.go","lineNumber":171,"sourceCode":"\t\tlogging.LogErrorf(\"write file [%s] failed: %s\", installPath, err)\n\t\treturn\n\t}\n\n\tdirs, err := os.ReadDir(unzipPath)\n\tif err != nil {\n\t\treturn\n\t}\n\n\tsrcPath := unzipPath\n\tif 1 == len(dirs) && dirs[0].IsDir() {\n\t\tsrcPath = filepath.Join(unzipPath, dirs[0].Name())\n\t}\n\n\t// 校验下载包自身声明的名称与请求安装的包名一致，防止把其他包的内容写入指定目录\n\t// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\n\tjsonFileName, ok := packageManifestNames[pkgType]\n\tif !ok {\n\t\treturn errors.New(\"invalid marketplace package type\")\n\t}\n\tpkg, parseErr := ParsePackageJSON(filepath.Join(srcPath, jsonFileName))\n\tif parseErr != nil || nil == pkg {\n\t\treturn errors.New(\"marketplace package manifest not found or invalid\")\n\t}\n\tif packageName != pkg.Name {\n\t\treturn fmt.Errorf(\"marketplace package name mismatch: expected [%s], got [%s]\", packageName, pkg.Name)\n\t}\n\n\tif err = filelock.Copy(srcPath, installPath); err != nil {\n\t\treturn\n\t}\n\treturn\n}\n\n// InstallLocalPackage 从已解压并验证的目录安装本地集市包。\nfunc InstallLocalPackage(sourcePath, installPath, pkgType, packageName string, update bool) (err error) {\n\tif err = os.MkdirAll(filepath.Dir(installPath), 0755); err != nil {","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/bazaar/install.go#L153-L189","documentation":"Returned by installPackage (kernel/bazaar/install.go:169-171) when the pkgType argument is not found in the packageManifestNames map. This map is built by inverting localPackageManifests, which defines exactly five valid types: plugins, themes, icons, templates, widgets. An unknown type string means the code cannot determine which manifest file name to look for in the extracted package.","triggerScenarios":"Calling InstallPackage with a pkgType value that is not one of: \"plugins\", \"themes\", \"icons\", \"templates\", \"widgets\".","commonSituations":"Passing a singular form like \"plugin\" instead of \"plugins\"; passing a type from an outdated or future API version; typo in the pkgType string; custom code that derives pkgType from user input without validation.","solutions":["Use one of the five valid pkgType values: plugins, themes, icons, templates, widgets","Validate pkgType against localPackageManifests values before calling InstallPackage","Check the API documentation or kernel/bazaar/local.go:39-45 for the canonical type list"],"exampleFix":"// before\nbazaar.InstallPackage(repoURL, repoHash, installPath, systemID, \"plugin\", pkgName, false)\n// after\nbazaar.InstallPackage(repoURL, repoHash, installPath, systemID, \"plugins\", pkgName, false)","handlingStrategy":"validation","validationCode":"var validPackageTypes = map[string]bool{\"plugins\": true, \"themes\": true, \"icons\": true, \"templates\": true, \"widgets\": true}\n\nfunc validatePackageType(pkgType string) error {\n    if !validPackageTypes[pkgType] {\n        return fmt.Errorf(\"invalid package type %q: must be one of plugins, themes, icons, templates, widgets\", pkgType)\n    }\n    return nil\n}","typeGuard":"func isValidPackageType(pkgType string) bool {\n    switch pkgType {\n    case \"plugins\", \"themes\", \"icons\", \"templates\", \"widgets\":\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Validate pkgType against the five known values before calling InstallPackage","Use the plural form (plugins, themes) not the singular (plugin, theme)","Reference kernel/bazaar/local.go:39-45 for the canonical manifest-to-type mapping"],"tags":["bazaar","marketplace","install","validation","go"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}