{"record":{"id":"65b87a4cb195193f","repo":"larksuite/cli","slug":"empty-pattern","errorCode":null,"errorMessage":"empty pattern","messagePattern":"empty pattern","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmdpolicy/validate.go","lineNumber":69,"sourceCode":"\t\t}\n\t}\n\tfor _, g := range r.Deny {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid deny glob %q: %w\", g, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateGlob rejects malformed doublestar patterns. doublestar.Match\n// returns an error for unbalanced brackets / bad escape sequences; that\n// error path is the canonical signal for \"this pattern is not valid\".\n//\n// We probe with an empty string -- the goal is to exercise the parser,\n// not to compute a match.\nfunc validateGlob(g string) error {\n\tif g == \"\" {\n\t\treturn fmt.Errorf(\"empty pattern\")\n\t}\n\tif _, err := doublestar.Match(g, \"\"); err != nil {\n\t\treturn err\n\t}\n\treturn nil\n}\n","sourceCodeStart":51,"sourceCodeEnd":76,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/cmdpolicy/validate.go#L51-L76","documentation":"validateGlob rejects an empty glob pattern outright with 'empty pattern' before consulting doublestar. An empty pattern is meaningless, so the library treats it as a configuration error rather than silently accepting a no-op rule.","triggerScenarios":"ValidateRule sees an Allow or Deny entry that is the empty string \"\", typically from a YAML list with a bare '-' item, a generator emitting empty list items, or an unset variable substituted into the policy.","commonSituations":"Config generators emitting empty entries; YAML like 'allow:\\n  -' producing an empty-string item; template rendering where an unset variable left an empty pattern.","solutions":["Remove the empty entry from the allow/deny list.","If the value comes from a variable, ensure it is set and non-empty before rendering.","If no patterns are needed, delete the whole allow or deny key."],"exampleFix":"// before\nallow:\n  - \"docs/*\"\n  - \"\"\n// after\nallow:\n  - \"docs/*\"","handlingStrategy":"validation","validationCode":"for _, g := range append(append([]string{}, rule.Allow...), rule.Deny...) {\n\tif strings.TrimSpace(g) == \"\" {\n\t\treturn fmt.Errorf(\"empty glob entry\")\n\t}\n}","typeGuard":"func hasEmptyPattern(list []string) bool {\n\tfor _, g := range list { if g == \"\" { return true } }\n\treturn false\n}","tryCatchPattern":null,"preventionTips":["Filter empty strings out of allow/deny lists when generating config.","Avoid emitting bare '-' list items in YAML templates.","Make generators omit the allow/deny key entirely when the list is empty.","Trim and check env-var-derived values before substituting into policy files."],"tags":["go","glob","config-validation","empty-value"],"backgroundTag":"empty-pattern","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}