{"record":{"id":"db97d26479b4b993","repo":"larksuite/cli","slug":"s-cannot-stat-q-w","errorCode":null,"errorMessage":"%s: cannot stat %q: %w","messagePattern":"(.+?): cannot stat %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/audit.go","lineNumber":85,"sourceCode":"// requireAbsolutePath rejects relative paths; relative paths would depend on\n// the process cwd and defeat the point of a static audit. Shell-style\n// shortcuts like `~` are home-relative, not cwd-relative — they are an\n// orthogonal concern and the audit is intentionally Go-stdlib strict here.\n// Callers that accept user-authored config (e.g. resolveFileRef) must\n// pre-resolve any such shortcuts before passing the path in.\nfunc requireAbsolutePath(target, label string) error {\n\tif !filepath.IsAbs(target) {\n\t\treturn fmt.Errorf(\"%s: path must be absolute, got %q\", label, target)\n\t}\n\treturn nil\n}\n\n// lstatNonDir stats the path without following symlinks, rejecting\n// directories. Returns the stat info for downstream steps to reuse.\nfunc lstatNonDir(target, label string) (fs.FileInfo, error) {\n\tinfo, err := vfs.Lstat(target)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: cannot stat %q: %w\", label, target, err)\n\t}\n\tif info.IsDir() {\n\t\treturn nil, fmt.Errorf(\"%s: path %q is a directory, not a file\", label, target)\n\t}\n\treturn info, nil\n}\n\n// resolveSymlinkIfAllowed resolves a symlink to its target when\n// params.AllowSymlinkPath is true, or rejects it otherwise. When the input\n// is not a symlink, target is returned unchanged. A symlink that points to\n// another symlink is rejected so callers only deal with a single hop.\nfunc resolveSymlinkIfAllowed(target string, linfo fs.FileInfo, params AuditParams) (string, error) {\n\tif linfo.Mode()&os.ModeSymlink == 0 {\n\t\treturn target, nil\n\t}\n\tif !params.AllowSymlinkPath {\n\t\treturn \"\", fmt.Errorf(\"%s: path %q is a symlink (not allowed)\", params.Label, target)\n\t}","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/audit.go#L67-L103","documentation":"lstatNonDir failed to Lstat the audited path via vfs.Lstat and wraps the underlying error with %w (unwrappable). The stat itself failed — most commonly the file does not exist — so the secure-path audit cannot proceed.","triggerScenarios":"AssertSecurePath -> lstatNonDir where vfs.Lstat(target) errors: nonexistent file, permission denied on a parent directory, broken path component, or an invalid path on the host.","commonSituations":"Binding points at a file that was deleted or renamed; typo in a configured path; running on a host where the mounted workspace lacks the file; parent directory unreadable due to permissions or sandboxing.","solutions":["Check the wrapped cause after 'cannot stat': ENOENT means fix or create the path; EACCES means fix directory permissions.","Verify the configured path exists on the machine running the CLI (ls the exact path).","Fix typos or stale references in the binding/config that point to moved files.","If running in a container/sandbox, mount or copy the file into the expected location."],"exampleFix":"// caller\nif _, err := os.Lstat(p); err != nil {\n    return fmt.Errorf(\"configured file missing, create or fix path %q\", p)\n}\nerr := binding.AssertSecurePath(p, params)","handlingStrategy":"validation","validationCode":"// preflight before AssertSecurePath\nif _, err := os.Lstat(p); err != nil {\n    if os.IsNotExist(err) { return fmt.Errorf(\"file %q does not exist; create it or fix the config\", p) }\n    return fmt.Errorf(\"cannot access %q: %w\", p, err)\n}","typeGuard":"func isStatErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"cannot stat\")\n}","tryCatchPattern":"if err := binding.AssertSecurePath(p, params); err != nil {\n    if isStatErr(err) && errors.Is(err, fs.ErrNotExist) {\n        return fmt.Errorf(\"configure an existing file path; %w\", err)\n    }\n    return err\n}","preventionTips":["Check file existence (and parent-dir readability) before configuring a binding.","Use vfs/os.Lstat in preflight to match the audit's own check.","In containers, verify the file is mounted at the expected path.","Fix permissions (chmod/chown) when the wrapped cause is EACCES."],"tags":["filesystem","path-validation","stat","security"],"backgroundTag":"file-not-found","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}