{"record":{"id":"5d15af894e3f1c1b","repo":"Tencent/WeKnora","slug":"invalid-base-dir-w","errorCode":null,"errorMessage":"invalid base dir: %w","messagePattern":"invalid base dir: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":115,"sourceCode":"\t// 检查是否包含潜在的 XSS 攻击\n\tfor _, pattern := range xssPatterns {\n\t\tif pattern.MatchString(input) {\n\t\t\treturn \"\", false\n\t\t}\n\t}\n\n\treturn strings.TrimSpace(input), true\n}\n\n// SafePathUnderBase 校验 filePath 是否落在 baseDir 下，防止路径遍历（如 ../../）。\n// 返回规范化的绝对路径；若路径逃逸出 baseDir 则返回错误。\nfunc SafePathUnderBase(baseDir, filePath string) (string, error) {\n\tif baseDir == \"\" || filePath == \"\" {\n\t\treturn \"\", fmt.Errorf(\"baseDir and filePath cannot be empty\")\n\t}\n\tabsBase, err := filepath.Abs(filepath.Clean(baseDir))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid base dir: %w\", err)\n\t}\n\tabsPath, err := filepath.Abs(filepath.Clean(filePath))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid file path: %w\", err)\n\t}\n\tsep := string(filepath.Separator)\n\tif absPath != absBase && !strings.HasPrefix(absPath, absBase+sep) {\n\t\treturn \"\", fmt.Errorf(\"path traversal denied: path is outside base directory\")\n\t}\n\treturn absPath, nil\n}\n\n// SafeFileName 校验并返回安全的“仅文件名”部分，防止路径遍历。\n// 仅保留最后一个路径成分，禁止 \"..\"、空名或仅含点，用于 SaveBytes 等场景。\nfunc SafeFileName(fileName string) (string, error) {\n\tif fileName == \"\" {\n\t\treturn \"\", fmt.Errorf(\"fileName cannot be empty\")\n\t}","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L97-L133","documentation":"Wrapping error in SafePathUnderBase: filepath.Abs(filepath.Clean(baseDir)) failed, so the base directory itself cannot be normalized to an absolute path. The underlying OS/filesystem error is wrapped and the path check aborts.","triggerScenarios":"Thrown at internal/utils/security.go:115 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the wrapped error from filepath.Abs","Fix the baseDir value (encoding, malformed path) before retrying"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}