{"record":{"id":"d79fd94e6b5e783c","repo":"Tencent/WeKnora","slug":"bucket-mismatch-in-path-got-s-want-s-d79fd9","errorCode":null,"errorMessage":"bucket mismatch in path: got %s, want %s","messagePattern":"bucket mismatch in path: got (.+?), want (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/s3.go","lineNumber":212,"sourceCode":"\t\treturn err\n\t}\n\treturn svc.CheckConnectivity(ctx)\n}\n\n// parseS3FilePath extracts the object name from a provider scheme: s3://{bucket}/{objectKey}\nfunc (s *s3FileService) parseS3FilePath(filePath string) (string, error) {\n\t// Provider scheme format: s3://{bucket}/{objectKey}\n\tconst prefix = \"s3://\"\n\tif !strings.HasPrefix(filePath, prefix) {\n\t\treturn \"\", fmt.Errorf(\"invalid S3 file path: %s\", filePath)\n\t}\n\trest := strings.TrimPrefix(filePath, prefix)\n\tparts := strings.SplitN(rest, \"/\", 2)\n\tif len(parts) != 2 || parts[0] == \"\" || parts[1] == \"\" {\n\t\treturn \"\", fmt.Errorf(\"invalid S3 file path: %s\", filePath)\n\t}\n\tif parts[0] != s.bucketName {\n\t\treturn \"\", fmt.Errorf(\"bucket mismatch in path: got %s, want %s\", parts[0], s.bucketName)\n\t}\n\tif err := utils.SafeObjectKey(parts[1]); err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid file path: %w\", err)\n\t}\n\treturn parts[1], nil\n}\n\n// SaveFile saves a file to S3\nfunc (s *s3FileService) SaveFile(ctx context.Context,\n\tfile *multipart.FileHeader, tenantID uint64, knowledgeID string,\n) (string, error) {\n\t// Generate object name\n\text := filepath.Ext(file.Filename)\n\tobjectName := fmt.Sprintf(\"%s%d/%s/%s%s\", s.pathPrefix, tenantID, knowledgeID, uuid.New().String(), ext)\n\n\t// Open file\n\tsrc, err := file.Open()\n\tif err != nil {","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/s3.go#L194-L230","documentation":"S3 path parser guard: the bucket segment of the s3:// path does not equal the service's configured bucket name, indicating a path minted by a different backend/deployment; the operation is rejected to prevent cross-bucket access.","triggerScenarios":"Thrown at internal/application/service/file/s3.go:212 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use paths previously returned by this S3 service","Align the configured bucket name with the deployment","Reject foreign-bucket paths at input validation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}