{"record":{"id":"6c7482705bacc538","repo":"flipped-aurora/gin-vue-admin","slug":"error-6c7482","errorCode":null,"errorMessage":"文件名包含非法字符，拒绝写入","messagePattern":"文件名包含非法字符，拒绝写入","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/service/system/auto_code_template.go","lineNumber":292,"sourceCode":"\nfunc (s *autoCodeTemplate) getTemplateStr(t string, info request.AutoFunc) (string, error) {\n\ttempPath := filepath.Join(global.GVA_CONFIG.AutoCode.Root, global.GVA_CONFIG.AutoCode.Server, \"resource\", \"function\", t+\".tpl\")\n\tfiles, err := template.New(filepath.Base(tempPath)).Funcs(autocode.GetTemplateFuncMap()).ParseFiles(tempPath)\n\tif err != nil {\n\t\treturn \"\", errors.Wrapf(err, \"[filepath:%s]读取模版文件失败!\", tempPath)\n\t}\n\tvar builder strings.Builder\n\terr = files.Execute(&builder, info)\n\tif err != nil {\n\t\tfmt.Println(err.Error())\n\t\treturn \"\", errors.Wrapf(err, \"[filpath:%s]生成文件失败!\", tempPath)\n\t}\n\treturn builder.String(), nil\n}\n\nfunc (s *autoCodeTemplate) addTemplateToAst(t string, info request.AutoFunc) error {\n\tif !isSafeFileName(info.HumpPackageName) {\n\t\treturn fmt.Errorf(\"文件名包含非法字符，拒绝写入\")\n\t}\n\ttPath := filepath.Join(global.GVA_CONFIG.AutoCode.Root, global.GVA_CONFIG.AutoCode.Server, \"router\", info.Package, info.HumpPackageName+\".go\")\n\tfuncName := fmt.Sprintf(\"Init%sRouter\", info.StructName)\n\n\trouterStr := \"RouterWithoutAuth\"\n\tif info.IsAuth {\n\t\trouterStr = \"Router\"\n\t}\n\n\tstmtStr := fmt.Sprintf(\"%s%s.%s(\\\"%s\\\", %sApi.%s)\", info.Abbreviation, routerStr, info.Method, info.Router, info.Abbreviation, info.FuncName)\n\tif info.IsPlugin {\n\t\ttPath = filepath.Join(global.GVA_CONFIG.AutoCode.Root, global.GVA_CONFIG.AutoCode.Server, \"plugin\", info.Package, \"router\", info.HumpPackageName+\".go\")\n\t\tstmtStr = fmt.Sprintf(\"group.%s(\\\"%s\\\", api%s.%s)\", info.Method, info.Router, info.StructName, info.FuncName)\n\t\tfuncName = \"Init\"\n\t}\n\n\tsrc, err := os.ReadFile(tPath)\n\tif err != nil {","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/flipped-aurora/gin-vue-admin/blob/3136500ef380842b0eb6c4daa87c3f8a47fcf9e0/server/service/system/auto_code_template.go#L274-L310","documentation":"addTemplateToAst (used by AddFunc to append a generated router function into an existing router file via AST rewriting) first checks the HumpPackageName with isSafeFileName. If it contains path separators, dots, or other unsafe characters, the write is refused to prevent path traversal / arbitrary file writes.","triggerScenarios":"Calling autoCode.AddFunc with request.AutoFunc where HumpPackageName contains characters like '/', '\\\\', '..', or other non [A-Za-z0-9_] characters, which would be embedded into a file path under server/router/<Package>/.","commonSituations":"Crafted or copy-pasted input in the code-generator UI; API clients calling AddFunc directly bypassing frontend validation; localized names or hyphenated names pasted into the package-name field.","solutions":["Use a valid Go identifier for HumpPackageName: letters, digits, underscore only, starting with a letter (e.g. myFeature).","Remove slashes, dots, spaces, and non-ASCII characters from the field in the generator form.","If calling the API directly, validate the field client-side with ^[A-Za-z][A-Za-z0-9_]*$ before submitting.","Do not paste full file paths into the package-name field — only the bare name."],"exampleFix":"// before\n{\"humpPackageName\": \"../evil\"}\n// after\n{\"humpPackageName\": \"evilRouter\"}","handlingStrategy":"validation","validationCode":"var identRe = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_]*$`)\nif !identRe.MatchString(humpPackageName) {\n    return errors.New(\"humpPackageName must be a plain Go identifier\")\n}","typeGuard":null,"tryCatchPattern":"if err := autoCodeService.AddFunc(info); err != nil {\n    if strings.Contains(err.Error(), \"非法字符\") {\n        return fmt.Errorf(\"sanitize HumpPackageName (got %q)\", info.HumpPackageName)\n    }\n    return err\n}","preventionTips":["Validate package-name inputs with ^[A-Za-z][A-Za-z0-9_]*$ on both frontend and backend","Never paste paths into name fields","Sanitize inputs from direct API clients, not only the UI"],"tags":["autocode","input-validation","security"],"backgroundTag":"unsafe-filename-rejected","analyzedSha":"3136500ef380842b0eb6c4daa87c3f8a47fcf9e0","analyzedAt":"2026-08-31T13:50:02.721Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}