{"record":{"id":"7097d68388736e93","repo":"siyuan-note/siyuan","slug":"invalid-package-type-7097d6","errorCode":null,"errorMessage":"invalid package type","messagePattern":"invalid package type","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/bazaar_rating.go","lineNumber":66,"sourceCode":"type bazaarPackageUserRatingData struct {\n\tRating int `json:\"rating\"`\n}\n\ntype bazaarPackageSetRatingData struct {\n\tRating          int                   `json:\"rating\"`\n\tRatingAvailable *bool                 `json:\"ratingAvailable\"`\n\tPublicRating    *bazaar.PackageRating `json:\"publicRating\"`\n\tDistribution    []int64               `json:\"distribution\"`\n}\n\n// ErrBazaarRatingRateLimited 表示评分请求受到云端频率限制。\nvar ErrBazaarRatingRateLimited = errors.New(\"bazaar rating rate limited\")\n\n// GetInstalledBazaarPackageRatings 获取指定已安装包的公开评分。\nfunc GetInstalledBazaarPackageRatings(ctx context.Context, pkgType string,\n\tpackageNames []string) (ratings map[string]*bazaar.PackageRating, eligiblePackageNames []string, err error) {\n\tif !isValidBazaarPackageType(pkgType) {\n\t\treturn nil, nil, errors.New(\"invalid package type\")\n\t}\n\n\tinstalledInfos, _, _, err := bazaarRatingInstalledPackageInfos(pkgType)\n\tif nil != err {\n\t\treturn nil, nil, err\n\t}\n\tinstalled := make(map[string]bool, len(installedInfos))\n\tfor _, info := range installedInfos {\n\t\tif \"\" == info.Pkg.InvalidReason {\n\t\t\tinstalled[info.Pkg.Name] = true\n\t\t}\n\t}\n\n\tnames := make([]string, 0, len(packageNames))\n\tseen := make(map[string]bool, len(packageNames))\n\tfor _, packageName := range packageNames {\n\t\tif !bazaar.IsValidPackageName(packageName) {\n\t\t\treturn nil, nil, fmt.Errorf(\"invalid package name: %s\", packageName)","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/afa823b6b4e4f183511e0bc0a3be93caa94c7c97/kernel/model/bazaar_rating.go#L48-L84","documentation":"Error returned at the top of model.GetInstalledBazaarPackageRatings (kernel/model/bazaar_rating.go:66) when isValidBazaarPackageType rejects pkgType. The rating subsystem accepts exactly plugins, widgets, icons, templates, themes (same set as the install enumeration in bazaar.go); anything else fails fast before any installed-info enumeration or cloud call. The same message also exists in validateBazaarPackageRatingRequest0 for the single-package endpoints.","triggerScenarios":"Calling /api/bazaar/getInstalledBazaarPackageRatings or the per-package rating endpoints with pkgType=\"plugin\" (singular), an empty string, or a custom type string invented by the client.","commonSituations":"Client reuses an internal type constant that doesn't match the bazaar vocabulary; copy-paste from another API that uses different type names; unvalidated query parameters forwarded straight to the kernel.","solutions":["Send one of: plugins, widgets, icons, templates, themes (lowercase, plural)","Validate pkgType at the client boundary with the same five-value whitelist before calling the API","Return a 400 with the allowed list instead of forwarding the raw value when building a proxy/frontend"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"switch pkgType {\ncase \"plugins\", \"widgets\", \"icons\", \"templates\", \"themes\":\n    // ok\ndefault:\n    return fmt.Errorf(\"invalid package type %q\", pkgType)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Share one constant set of package-type strings between install and rating code paths","Test client calls against the five valid values; add a unit test for the whitelist"],"tags":["marketplace","ratings","input-validation","package-type"],"backgroundTag":"invalid-enum-value","analyzedSha":"afa823b6b4e4f183511e0bc0a3be93caa94c7c97","analyzedAt":"2026-08-18T17:04:10.865Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}