{"record":{"id":"ad547c10a8ea8b5d","repo":"Tencent/WeKnora","slug":"basedir-and-filepath-cannot-be-empty","errorCode":null,"errorMessage":"baseDir and filePath cannot be empty","messagePattern":"baseDir and filePath cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":111,"sourceCode":"\tif !utf8.ValidString(input) {\n\t\treturn \"\", false\n\t}\n\n\t// 检查是否包含潜在的 XSS 攻击\n\tfor _, pattern := range xssPatterns {\n\t\tif pattern.MatchString(input) {\n\t\t\treturn \"\", false\n\t\t}\n\t}\n\n\treturn strings.TrimSpace(input), true\n}\n\n// SafePathUnderBase 校验 filePath 是否落在 baseDir 下，防止路径遍历（如 ../../）。\n// 返回规范化的绝对路径；若路径逃逸出 baseDir 则返回错误。\nfunc SafePathUnderBase(baseDir, filePath string) (string, error) {\n\tif baseDir == \"\" || filePath == \"\" {\n\t\treturn \"\", fmt.Errorf(\"baseDir and filePath cannot be empty\")\n\t}\n\tabsBase, err := filepath.Abs(filepath.Clean(baseDir))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid base dir: %w\", err)\n\t}\n\tabsPath, err := filepath.Abs(filepath.Clean(filePath))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid file path: %w\", err)\n\t}\n\tsep := string(filepath.Separator)\n\tif absPath != absBase && !strings.HasPrefix(absPath, absBase+sep) {\n\t\treturn \"\", fmt.Errorf(\"path traversal denied: path is outside base directory\")\n\t}\n\treturn absPath, nil\n}\n\n// SafeFileName 校验并返回安全的“仅文件名”部分，防止路径遍历。\n// 仅保留最后一个路径成分，禁止 \"..\"、空名或仅含点，用于 SaveBytes 等场景。","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L93-L129","documentation":"Input validation in SafePathUnderBase: one of the two arguments — baseDir or filePath — is an empty string, so path containment cannot even be evaluated. Raised before any cleaning/abs computation; callers should treat it as a programming/argument bug rather than a traversal attempt.","triggerScenarios":"Thrown at internal/utils/security.go:111 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass a non-empty, configured base directory and file path","Check configuration loading if baseDir is unexpectedly empty"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}