{"record":{"id":"f180194d365002a4","repo":"larksuite/cli","slug":"file-provider-security-audit-failed-w","errorCode":null,"errorMessage":"file provider security audit failed: %w","messagePattern":"file provider security audit failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve_file.go","lineNumber":46,"sourceCode":"\t// raw, so we mirror that resolution here before the audit — otherwise\n\t// an unambiguous home-relative path would be rejected by\n\t// requireAbsolutePath, which is meant to guard against cwd-relative\n\t// paths (a different concern). expandTildePath honours OPENCLAW_HOME so\n\t// a tilde inside an OPENCLAW_HOME-overridden config resolves to the\n\t// same absolute path OpenClaw itself would have used.\n\ttargetPath := expandTildePath(pc.Path)\n\n\t// Security audit on file path\n\tsecurePath, err := AssertSecurePath(AuditParams{\n\t\tTargetPath:            targetPath,\n\t\tLabel:                 \"secrets.providers file path\",\n\t\tTrustedDirs:           pc.TrustedDirs,\n\t\tAllowInsecurePath:     pc.AllowInsecurePath,\n\t\tAllowReadableByOthers: false, // file provider: strict by default\n\t\tAllowSymlinkPath:      false,\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"file provider security audit failed: %w\", err)\n\t}\n\n\t// Read file content\n\tmaxBytes := pc.MaxBytes\n\tif maxBytes <= 0 {\n\t\tmaxBytes = DefaultFileMaxBytes\n\t}\n\n\t// Note: vfs.ReadFile loads the entire file. maxBytes is enforced post-read\n\t// because vfs does not expose a size-limited reader. For secret files this\n\t// is acceptable (default limit 1 MiB; secrets are typically < 1 KB).\n\tdata, err := vfs.ReadFile(securePath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to read secret file %s: %w\", securePath, err)\n\t}\n\n\tif len(data) > maxBytes {\n\t\treturn \"\", fmt.Errorf(\"file provider exceeded maxBytes (%d)\", maxBytes)","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve_file.go#L28-L64","documentation":"Before reading a secret file, the file provider runs a security audit (assertSecurePath) that rejects paths with insecure permissions, symlinks, placement outside trusted directories, or readability by other users. This error wraps the underlying audit failure. The provider is strict by default: symlinks are disallowed and AllowReadableByOthers is false.","triggerScenarios":"Calling resolveSecretRef with a {source:\"file\"} SecretRef where the resolved path (after ~ expansion) fails assertSecurePath — e.g. the file is group/world-readable, is a symlink, lives outside TrustedDirs, or AllowInsecurePath is false and permissions are loose.","commonSituations":"The secret file was created with default umask 0022 making it world-readable; a dotfile manager symlinks the secrets file into place; the file lives in a directory not listed in TrustedDirs; the config copied from another machine carries different ownership.","solutions":["Tighten the file permissions: `chmod 600 <secret-file>` (and `chmod 700` its parent directory).","Replace the symlink with a real file, or allow symlinked paths if your threat model permits it.","Add the containing directory to ProviderConfig.TrustedDirs, or set AllowInsecurePath/AllowReadableByOthers deliberately if the environment requires it."],"exampleFix":"// before (shell)\nls -l ~/.config/myapp/secrets.json  # -rw-r--r--\n// after\nchmod 600 ~/.config/myapp/secrets.json","handlingStrategy":"validation","validationCode":"info, err := os.Stat(os.ExpandEnv(p))\nif err != nil { return err }\nif info.Mode()&0o077 != 0 {\n    return fmt.Errorf(\"secret file %s must be 0600, got %v\", p, info.Mode().Perm())\n}","typeGuard":null,"tryCatchPattern":"secret, err := resolveSecretRef(ctx, ref)\nif err != nil {\n    var auditErr *os.PathError\n    if strings.Contains(err.Error(), \"security audit failed\") {\n        // chmod 600 the file, remove symlink, or add dir to TrustedDirs\n    }\n    return err\n}","preventionTips":["Always create secret files with chmod 600 and their parent dirs with chmod 700.","Do not symlink secret files (dotfile managers: use copies or encrypted overlays).","Keep secret files inside directories declared in TrustedDirs.","Re-check permissions after restoring from backups or syncing across machines."],"tags":["secrets","file-provider","security","permissions"],"backgroundTag":"insecure-file-permissions","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}