{"record":{"id":"e3e6403c94756c24","repo":"larksuite/cli","slug":"s-must-not-be-empty-e3e640","errorCode":null,"errorMessage":"%s must not be empty","messagePattern":"(.+?) must not be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/vfs/localfileio/path.go","lineNumber":153,"sourceCode":"\tresolved, err := resolveNearestAncestor(path)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"cannot resolve symlinks: %w\", err)\n\t}\n\treturn resolved, nil\n}\n\n// safePath is the shared implementation for SafeOutputPath and SafeInputPath.\n// A path is accepted when its real location falls inside the built-in\n// allowlist (cwd, /tmp, ~/files) and outside the built-in denylist; deny wins\n// over allow, cwd included. Both lists are compiled in (policy.go), which\n// also documents the two bounded environment inputs that remain.\nfunc safePath(raw, flagName string) (string, error) {\n\tisOutputFlag := flagName == \"--output\"\n\tif err := charcheck.RejectControlChars(raw, flagName); err != nil {\n\t\treturn \"\", err\n\t}\n\tif strings.TrimSpace(raw) == \"\" {\n\t\treturn \"\", fmt.Errorf(\"%s must not be empty\", flagName)\n\t}\n\tif err := validatePathPlatform(raw); err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: %w\", flagName, err)\n\t}\n\tif err := rejectForeignAbsolute(raw, flagName); err != nil {\n\t\treturn \"\", err\n\t}\n\n\tcwd, err := vfs.Getwd()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"cannot determine working directory: %w\", err)\n\t}\n\t// Every reading of the argument must pass, not just the one this function\n\t// returns: callers that keep the original string (SafeLocalFlagPath does)\n\t// open the location the OS computes, and for a \"~/...\" argument that is a\n\t// literal \"~\" entry in the working directory rather than the home\n\t// directory. A path is only safe when both readings are.\n\tinterps, err := interpretations(raw, cwd)","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/vfs/localfileio/path.go#L135-L171","documentation":"safePath (shared by SafeOutputPath and SafeInputPath) rejects a value that is empty or whitespace-only after the control-character check, prefixing the message with the flag name. An empty path can never satisfy the allowlist policy, so it fails early with a clear message.","triggerScenarios":"Calling SafeOutputPath(\"\") or SafeInputPath(\" \") — an --output/--file flag bound to an unset variable, an empty config field, or a templating placeholder like {{output}} left unsubstituted.","commonSituations":"Script variable $OUT never set; YAML/JSON config with an empty string value; templated command where the substitution failed; shell ${VAR} expanding to empty because an earlier step produced no output.","solutions":["Provide a concrete value for the flag before invoking the command","Guard in shell: `: \"${OUTPUT:?OUTPUT not set}\"` before running","Fix the templating/config so the placeholder is actually filled"],"exampleFix":"// before\ncmd.Flags().String(\"output\", cfg.Output, \"\") // cfg.Output == \"\"\n// error: --output must not be empty\n// after\nif cfg.Output == \"\" {\n    cfg.Output = \"./out.bin\"\n}\ncmd.Flags().String(\"output\", cfg.Output, \"\")","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(out) == \"\" {\n    return errors.New(\"--output is required\")\n}","typeGuard":"func hasOutputPath(v string) bool { return strings.TrimSpace(v) != \"\" }","tryCatchPattern":"if _, err := localfileio.SafeOutputPath(flagValue); err != nil {\n    return fmt.Errorf(\"--output: %w\", err)\n}","preventionTips":["Provide defaults for output flags in config","Guard shell variables with ${OUT:?msg}","Verify templating placeholders are substituted before exec"],"tags":["validation","path","empty-input","flag"],"backgroundTag":"empty-path-argument","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}