{"record":{"id":"9bcc967426ea3f66","repo":"siyuan-note/siyuan","slug":"marketplace-package-name-mismatch-expected-s","errorCode":null,"errorMessage":"marketplace package name mismatch: expected [%s], got [%s]","messagePattern":"marketplace package name mismatch: expected \\[(.+?)\\], got \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/bazaar/install.go","lineNumber":178,"sourceCode":"\t}\n\n\tsrcPath := unzipPath\n\tif 1 == len(dirs) && dirs[0].IsDir() {\n\t\tsrcPath = filepath.Join(unzipPath, dirs[0].Name())\n\t}\n\n\t// 校验下载包自身声明的名称与请求安装的包名一致，防止把其他包的内容写入指定目录\n\t// https://github.com/siyuan-note/siyuan/security/advisories/GHSA-rpx2-p6hp-x5gj\n\tjsonFileName, ok := packageManifestNames[pkgType]\n\tif !ok {\n\t\treturn errors.New(\"invalid marketplace package type\")\n\t}\n\tpkg, parseErr := ParsePackageJSON(filepath.Join(srcPath, jsonFileName))\n\tif parseErr != nil || nil == pkg {\n\t\treturn errors.New(\"marketplace package manifest not found or invalid\")\n\t}\n\tif packageName != pkg.Name {\n\t\treturn fmt.Errorf(\"marketplace package name mismatch: expected [%s], got [%s]\", packageName, pkg.Name)\n\t}\n\n\tif err = filelock.Copy(srcPath, installPath); err != nil {\n\t\treturn\n\t}\n\treturn\n}\n\n// InstallLocalPackage 从已解压并验证的目录安装本地集市包。\nfunc InstallLocalPackage(sourcePath, installPath, pkgType, packageName string, update bool) (err error) {\n\tif err = os.MkdirAll(filepath.Dir(installPath), 0755); err != nil {\n\t\treturn\n\t}\n\n\tvar fallbackInstallTime time.Time\n\tif info, statErr := os.Stat(installPath); statErr == nil {\n\t\tfallbackInstallTime = info.ModTime()\n\t}","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/bazaar/install.go#L160-L196","documentation":"Returned by installPackage (kernel/bazaar/install.go:177-178) when the manifest's name field does not match the packageName argument. This is a security check (GHSA-rpx2-p6hp-x5gj) to prevent a confusion attack where a downloaded package declares a different name than expected, which could cause its contents to be written to another package's directory. The error message includes both the expected and actual names.","triggerScenarios":"Calling InstallPackage where packageName does not match the \"name\" field in the package's manifest JSON (e.g. plugin.json).","commonSituations":"Package was renamed by the author but the marketplace listing or local cache still references the old name; repoURL was changed to point at a fork with a different name; inconsistent packageName passed by the calling code; user manually edited the manifest name field.","solutions":["Ensure packageName matches the name field in the package's manifest exactly","Update to the latest package metadata from the bazaar to get the correct name","If the package was renamed, use the new name from the marketplace listing","Verify the repoURL points to the correct repository"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func verifyPackageNameMatch(srcPath, jsonFileName, expectedName string) error {\n    pkg, err := bazaar.ParsePackageJSON(filepath.Join(srcPath, jsonFileName))\n    if err != nil || pkg == nil {\n        return fmt.Errorf(\"cannot read manifest to verify name\")\n    }\n    if pkg.Name != expectedName {\n        return fmt.Errorf(\"package name mismatch: expected %q, manifest says %q\", expectedName, pkg.Name)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass the packageName that matches the manifest's name field exactly","Refresh package metadata from the bazaar before installing to get the current name","Do not rename packages in manifests without updating the bazaar listing"],"tags":["bazaar","marketplace","install","security","manifest","go"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}