{"record":{"id":"b494aee1017ae500","repo":"siyuan-note/siyuan","slug":"marketplace-package-contains-an-unsupported-file","errorCode":null,"errorMessage":"marketplace package contains an unsupported file","messagePattern":"marketplace package contains an unsupported file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/bazaar/local.go","lineNumber":141,"sourceCode":"\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc extractLocalPackageItem(item *zip.File, destination string, extractedTotal *uint64) error {\n\tname := strings.ReplaceAll(item.Name, \"\\\\\", \"/\")\n\tif name == \"\" || strings.HasPrefix(name, \"/\") {\n\t\treturn errors.New(\"marketplace package contains an invalid path\")\n\t}\n\tdestinationPath := filepath.Join(destination, filepath.FromSlash(name))\n\tif !gulu.File.IsSubPath(destination, destinationPath) {\n\t\treturn errors.New(\"marketplace package contains an invalid path\")\n\t}\n\n\tmode := item.Mode()\n\tif mode&os.ModeSymlink != 0 || (!mode.IsRegular() && !mode.IsDir()) {\n\t\treturn errors.New(\"marketplace package contains an unsupported file\")\n\t}\n\tif mode.IsDir() {\n\t\treturn os.MkdirAll(destinationPath, 0755)\n\t}\n\tif err := os.MkdirAll(filepath.Dir(destinationPath), 0755); err != nil {\n\t\treturn err\n\t}\n\n\tsource, err := item.Open()\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer source.Close()\n\ttarget, err := os.OpenFile(destinationPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)\n\tif err != nil {\n\t\treturn err\n\t}\n\twritten, copyErr := io.Copy(target, io.LimitReader(source, int64(maxLocalPackageFileSize)+1))","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/bazaar/local.go#L123-L159","documentation":"A zip entry's mode is neither a regular file nor a directory (e.g. symlink, device, socket, named pipe). Thrown by extractLocalPackageItem (kernel/bazaar/local.go:139-141) which explicitly rejects os.ModeSymlink and any non-regular/non-dir mode. Marketplace packages may only ship regular files and directories.","triggerScenarios":"ExtractLocalPackage encounters an entry whose zip FileHeader mode has the symlink bit set or denotes a special file type. Common when archives capture symlink-heavy trees like node_modules/.bin or .cache.","commonSituations":"The author zipped a directory containing symlinks (node_modules, pnpm cache, framework symlinks); a malicious archive includes device files or symlinks pointing outside the root.","solutions":["Strip symlinks before zipping (resolve them to real files, or exclude them)","Exclude symlink-heavy directories like node_modules, .cache, .bin from the archive","Re-package using a tool that materializes symlinks into regular files"],"exampleFix":"# before: node_modules symlinks captured\nzip -r pkg.zip . -x 'node_modules/*'\n# (if symlinks elsewhere) zip -ry captures them as symlinks -> rejected\n\n# after: exclude symlink-heavy trees entirely\nzip -r pkg.zip . -x 'node_modules/*' '.pnpm-store/*' '*/.bin/*'","handlingStrategy":"validation","validationCode":"func assertOnlyRegularAndDir(path string) error {\n    r, err := zip.OpenReader(path)\n    if err != nil { return err }\n    defer r.Close()\n    for _, f := range r.File {\n        m := f.Mode()\n        if m&os.ModeSymlink != 0 || (!m.IsRegular() && !m.IsDir()) {\n            return fmt.Errorf(\"entry %q has unsupported mode %v\", f.Name, m)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err != nil { return fmt.Errorf(\"package contains unsupported file type: %w\", err) }","preventionTips":["Exclude symlink-heavy trees (node_modules, .bin, .cache) before zipping","Resolve symlinks to real files if their target is needed in the package","Audit archive modes with `zipinfo` and strip special-file entries"],"tags":["zip","archive","bazaar","security","symlink"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}