{"record":{"id":"b48558a2334f42f9","repo":"larksuite/cli","slug":"invalid-allow-glob-q-w","errorCode":null,"errorMessage":"invalid allow glob %q: %w","messagePattern":"invalid allow glob %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmdpolicy/validate.go","lineNumber":50,"sourceCode":"\tif r == nil {\n\t\treturn nil\n\t}\n\n\tif r.MaxRisk != \"\" {\n\t\tif !r.MaxRisk.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid max_risk %q: must be one of read|write|high-risk-write\", r.MaxRisk)\n\t\t}\n\t}\n\n\tfor _, id := range r.Identities {\n\t\tif !id.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid identities entry %q: must be 'user' or 'bot'\", id)\n\t\t}\n\t}\n\n\tfor _, g := range r.Allow {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid allow glob %q: %w\", g, err)\n\t\t}\n\t}\n\tfor _, g := range r.Deny {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid deny glob %q: %w\", g, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateGlob rejects malformed doublestar patterns. doublestar.Match\n// returns an error for unbalanced brackets / bad escape sequences; that\n// error path is the canonical signal for \"this pattern is not valid\".\n//\n// We probe with an empty string -- the goal is to exercise the parser,\n// not to compute a match.\nfunc validateGlob(g string) error {\n\tif g == \"\" {","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/cmdpolicy/validate.go#L32-L68","documentation":"ValidateRule passes each Rule.Allow pattern through validateGlob, which probes the pattern with doublestar.Match to exercise the parser. A pattern doublestar cannot parse (unbalanced brackets, bad escape sequences) is wrapped as 'invalid allow glob %q: %w'. This exists because a malformed glob never matches anything, so a typo'd allow list would silently allow nothing.","triggerScenarios":"Calling ValidateRule with a Rule whose Allow slice contains a malformed doublestar pattern, e.g. \"docs/[abc\" (unclosed character class) or \"a\\\\\" (trailing escape).","commonSituations":"Hand-writing globs in policy YAML and leaving a bracket unclosed; incorrect backslash escaping on Windows paths; pasting a regex into a glob field; whitespace-only patterns.","solutions":["Fix the pattern syntax: balance all [ ] brackets and remove dangling escape backslashes.","Test the pattern with doublestar.Match locally against a sample path.","Escape special characters like [ and ? if the value is meant to match literally."],"exampleFix":"// before\nallow: [\"docs/[abc\"]\n// after\nallow: [\"docs/*\"]","handlingStrategy":"validation","validationCode":"for _, g := range rule.Allow {\n\tif _, err := doublestar.Match(g, \"\"); err != nil {\n\t\treturn fmt.Errorf(\"bad allow glob %q: %w\", g, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := cmdpolicy.ValidateRule(rule); err != nil {\n\treturn fmt.Errorf(\"policy load rejected: %w\", err)\n}","preventionTips":["Test every glob against a sample positive and negative path before committing the policy.","Escape literal [ ? * characters when the pattern is meant to match literally.","Prefer simple wildcards (docs/*) over complex character classes.","Lint policy files in CI with the validate subcommand."],"tags":["go","glob","policy","config-validation"],"backgroundTag":"invalid-glob-pattern","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}