{"record":{"id":"7de32f6cd5723244","repo":"larksuite/cli","slug":"s-path-q-is-not-inside-any-trusted-directory","errorCode":null,"errorMessage":"%s: path %q is not inside any trusted directory","messagePattern":"(.+?): path %q is not inside any trusted directory","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/audit.go","lineNumber":132,"sourceCode":"\t}\n\treturn resolved, nil\n}\n\n// requireInTrustedDirs enforces that effectivePath lives under one of the\n// caller-declared trusted directories, if any were declared. An empty\n// trustedDirs list disables the check.\nfunc requireInTrustedDirs(effectivePath string, trustedDirs []string, label string) error {\n\tif len(trustedDirs) == 0 {\n\t\treturn nil\n\t}\n\tcleaned := filepath.Clean(effectivePath)\n\tfor _, dir := range trustedDirs {\n\t\tcleanDir := filepath.Clean(dir)\n\t\tif cleaned == cleanDir || strings.HasPrefix(cleaned, cleanDir+\"/\") {\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\"%s: path %q is not inside any trusted directory\", label, effectivePath)\n}\n","sourceCodeStart":114,"sourceCodeEnd":134,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit.go#L114-L134","documentation":"requireInTrustedDirs enforces the caller-declared TrustedDirs allowlist: the (symlink-resolved) effective path must equal a trusted directory or live under one of them. The library throws this because a path outside the declared trusted roots could be swapped or planted by a lower-privileged user, defeating the security audit. An empty TrustedDirs list disables the check entirely.","triggerScenarios":"AssertSecurePath called with non-empty AuditParams.TrustedDirs while filepath.Clean(effectivePath) neither equals any cleaned trusted dir nor has it as a path-segment prefix; commonly after a symlink resolves somewhere outside the trusted roots.","commonSituations":"Config entry points at ~/scripts/tool.sh but TrustedDirs only contains /usr/local/bin or /opt/tool/bin; symlink in a trusted dir pointing to a user-writable location outside the roots; TrustedDirs entries with trailing slashes or uncleaned forms compared incorrectly against unusual paths; user moved a script to a different directory.","solutions":["Move the file into one of the declared trusted directories, or configure the exact path of a file already inside them","Add the file's real directory to TrustedDirs in the configuration that declares them (only if that directory meets your trust requirements)","Run readlink -f on the configured path — if it escapes the trusted dirs, fix the symlink","Normalize TrustedDirs entries (absolute, no trailing slash) so prefix matching works as intended"],"exampleFix":"// before\nTrustedDirs: []string{\"/opt/tool/bin\"}, TargetPath: \"/home/alice/tool.sh\"\n// after: move the script and point at it\nmv /home/alice/tool.sh /opt/tool/bin/tool.sh; TargetPath: \"/opt/tool/bin/tool.sh\"","handlingStrategy":"validation","validationCode":"func inTrustedDirs(p string, dirs []string) bool {\n  c := filepath.Clean(p)\n  for _, d := range dirs {\n    cd := filepath.Clean(d)\n    if c == cd || strings.HasPrefix(c, cd+string(os.PathSeparator)) { return true }\n  }\n  return false\n}\n// call before AssertSecurePath: if !inTrustedDirs(target, trustedDirs) { fix path or dirs }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep configured files inside declared trusted directories","Resolve symlinks before verifying trust — resolution may leave the trusted roots","Declare trusted dirs as clean absolute paths without trailing slashes","Review TrustedDirs whenever you move scripts or reinstall tools"],"tags":["security-audit","path-validation","allowlist"],"backgroundTag":"path-outside-trusted-dirs","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}