{"record":{"id":"da182325e2be5160","repo":"larksuite/cli","slug":"invalid-deny-glob-q-w","errorCode":null,"errorMessage":"invalid deny glob %q: %w","messagePattern":"invalid deny glob %q: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmdpolicy/validate.go","lineNumber":55,"sourceCode":"\t\tif !r.MaxRisk.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid max_risk %q: must be one of read|write|high-risk-write\", r.MaxRisk)\n\t\t}\n\t}\n\n\tfor _, id := range r.Identities {\n\t\tif !id.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid identities entry %q: must be 'user' or 'bot'\", id)\n\t\t}\n\t}\n\n\tfor _, g := range r.Allow {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid allow glob %q: %w\", g, err)\n\t\t}\n\t}\n\tfor _, g := range r.Deny {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid deny glob %q: %w\", g, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateGlob rejects malformed doublestar patterns. doublestar.Match\n// returns an error for unbalanced brackets / bad escape sequences; that\n// error path is the canonical signal for \"this pattern is not valid\".\n//\n// We probe with an empty string -- the goal is to exercise the parser,\n// not to compute a match.\nfunc validateGlob(g string) error {\n\tif g == \"\" {\n\t\treturn fmt.Errorf(\"empty pattern\")\n\t}\n\tif _, err := doublestar.Match(g, \"\"); err != nil {\n\t\treturn err\n\t}","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/cmdpolicy/validate.go#L37-L73","documentation":"Same check as the allow globs but applied to Rule.Deny: each deny pattern is parsed via doublestar.Match in validateGlob, and an unparseable pattern produces 'invalid deny glob %q: %w'. This matters even more for deny lists because a malformed deny pattern silently denies nothing, weakening the safety contract.","triggerScenarios":"Calling ValidateRule with a Rule whose Deny slice contains a malformed doublestar pattern such as \"secret/[a-\" or a pattern with a bad escape sequence.","commonSituations":"Windows-style backslash paths pasted into deny globs; incomplete edits leaving an unclosed character class; generated configs emitting empty or truncated deny patterns.","solutions":["Repair the pattern: close all character classes and fix escape sequences.","Use forward slashes in globs; doublestar uses '/' as separator.","Validate the deny list with the policy validate subcommand before deploying."],"exampleFix":"// before\ndeny: [\"secret/[a-\"]\n// after\ndeny: [\"secret/*\"]","handlingStrategy":"validation","validationCode":"for _, g := range rule.Deny {\n\tif g == \"\" {\n\t\treturn fmt.Errorf(\"empty deny pattern\")\n\t}\n\tif _, err := doublestar.Match(g, \"\"); err != nil {\n\t\treturn fmt.Errorf(\"bad deny glob %q: %w\", g, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := cmdpolicy.ValidateRule(rule); err != nil {\n\t// fail closed: refuse to start with an invalid deny glob\n\tlog.Fatalf(\"refusing to load policy: %v\", err)\n}","preventionTips":["Treat deny-list errors as fatal — never fall back to a degraded rule.","Use forward slashes in glob patterns even on Windows.","Unit-test every deny pattern against the paths it must match.","Run the policy validate subcommand before deploying deny changes."],"tags":["go","glob","policy","config-validation"],"backgroundTag":"invalid-glob-pattern","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}