flipped-aurora/gin-vue-admin · error

文件名包含非法字符，拒绝写入

Error message

文件名包含非法字符，拒绝写入

What it means

addTemplateToAst (used by AddFunc to append a generated router function into an existing router file via AST rewriting) first checks the HumpPackageName with isSafeFileName. If it contains path separators, dots, or other unsafe characters, the write is refused to prevent path traversal / arbitrary file writes.

Source

Thrown at server/service/system/auto_code_template.go:292

func (s *autoCodeTemplate) getTemplateStr(t string, info request.AutoFunc) (string, error) {
	tempPath := filepath.Join(global.GVA_CONFIG.AutoCode.Root, global.GVA_CONFIG.AutoCode.Server, "resource", "function", t+".tpl")
	files, err := template.New(filepath.Base(tempPath)).Funcs(autocode.GetTemplateFuncMap()).ParseFiles(tempPath)
	if err != nil {
		return "", errors.Wrapf(err, "[filepath:%s]读取模版文件失败!", tempPath)
	}
	var builder strings.Builder
	err = files.Execute(&builder, info)
	if err != nil {
		fmt.Println(err.Error())
		return "", errors.Wrapf(err, "[filpath:%s]生成文件失败!", tempPath)
	}
	return builder.String(), nil
}

func (s *autoCodeTemplate) addTemplateToAst(t string, info request.AutoFunc) error {
	if !isSafeFileName(info.HumpPackageName) {
		return fmt.Errorf("文件名包含非法字符，拒绝写入")
	}
	tPath := filepath.Join(global.GVA_CONFIG.AutoCode.Root, global.GVA_CONFIG.AutoCode.Server, "router", info.Package, info.HumpPackageName+".go")
	funcName := fmt.Sprintf("Init%sRouter", info.StructName)

	routerStr := "RouterWithoutAuth"
	if info.IsAuth {
		routerStr = "Router"
	}

	stmtStr := fmt.Sprintf("%s%s.%s(\"%s\", %sApi.%s)", info.Abbreviation, routerStr, info.Method, info.Router, info.Abbreviation, info.FuncName)
	if info.IsPlugin {
		tPath = filepath.Join(global.GVA_CONFIG.AutoCode.Root, global.GVA_CONFIG.AutoCode.Server, "plugin", info.Package, "router", info.HumpPackageName+".go")
		stmtStr = fmt.Sprintf("group.%s(\"%s\", api%s.%s)", info.Method, info.Router, info.StructName, info.FuncName)
		funcName = "Init"
	}

	src, err := os.ReadFile(tPath)
	if err != nil {

View on GitHub (pinned to 3136500ef3)

Solutions

1. Use a valid Go identifier for HumpPackageName: letters, digits, underscore only, starting with a letter (e.g. myFeature).
2. Remove slashes, dots, spaces, and non-ASCII characters from the field in the generator form.
3. If calling the API directly, validate the field client-side with ^[A-Za-z][A-Za-z0-9_]*$ before submitting.
4. Do not paste full file paths into the package-name field — only the bare name.

Example fix

// before
{"humpPackageName": "../evil"}
// after
{"humpPackageName": "evilRouter"}

var identRe = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_]*$`)
if !identRe.MatchString(humpPackageName) {
    return errors.New("humpPackageName must be a plain Go identifier")
}

if err := autoCodeService.AddFunc(info); err != nil {
    if strings.Contains(err.Error(), "非法字符") {
        return fmt.Errorf("sanitize HumpPackageName (got %q)", info.HumpPackageName)
    }
    return err
}

When it happens

Trigger: Calling autoCode.AddFunc with request.AutoFunc where HumpPackageName contains characters like '/', '\\', '..', or other non [A-Za-z0-9_] characters, which would be embedded into a file path under server/router/<Package>/.

Common situations: Crafted or copy-pasted input in the code-generator UI; API clients calling AddFunc directly bypassing frontend validation; localized names or hyphenated names pasted into the package-name field.

Related errors

• 路径越过根目录: %s
• autocode根路径未配置
• apis 需为JSON数组或逗号分隔字符串
• Package为空!
• 请先前往插件市场个人中心获取 AiPath 并填写到 config.yaml 中

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/6c7482705bacc538. Report an issue: GitHub.