What causes "invalid plugin archive name" in flipped-aurora/gin-vue-admin?

Re-send the multipart request ensuring the filename is a real archive name, e.g. curl -F 'file=@myplugin.zip'.

invalid plugin archive name

Error message

invalid plugin archive name

What it means

installSubPlugin validates the uploaded file's basename before writing it under tempDir: if the trimmed filename base is '.' or a path separator, there is no usable archive name, so it returns 'invalid plugin archive name'. This blocks empty/degenerate multipart filenames from creating bad temp paths.

Source

Thrown at server/service/system/auto_code_plugin.go:183

	}
	if err = os.MkdirAll(serverRoot, 0755); err != nil {
		return -1, -1, err
	}
	tempDir, err := os.MkdirTemp(serverRoot, "gva-plugin-")
	if err != nil {
		return -1, -1, err
	}
	defer os.RemoveAll(tempDir)

	src, err := file.Open()
	if err != nil {
		return -1, -1, err
	}
	defer src.Close()

	archiveName := filepath.Base(strings.TrimSpace(file.Filename))
	if archiveName == "." || archiveName == string(filepath.Separator) {
		return -1, -1, errors.New("invalid plugin archive name")
	}
	archivePath, err := utils.JoinWithinRoot(tempDir, archiveName)
	if err != nil {
		return -1, -1, err
	}
	out, err := os.Create(archivePath)
	if err != nil {
		return -1, -1, err
	}
	if _, err = io.Copy(out, src); err != nil {
		out.Close()
		return -1, -1, err
	}
	if err = out.Close(); err != nil {
		return -1, -1, err
	}

	paths, err := utils.Unzip(archivePath, tempDir)

View on GitHub (pinned to 3136500ef3)

Solutions

Re-send the multipart request ensuring the filename is a real archive name, e.g. curl -F 'file=@myplugin.zip'.
On the client, validate the selected file has a non-empty name ending in .zip before upload.
Server-side, reject earlier at the API layer with a clearer message when file.Filename is blank.

Example fix

// before
body.append('file', blob)            // no filename -> invalid
// after
body.append('file', blob, 'myplugin.zip')
// or
formData.append('file', fileInput.files[0], fileInput.files[0].name)

Defensive patterns

Strategy: validation

Validate before calling

const name = file.name?.trim()
if (!name || name === '.' || name === '/' || name === '\\') {
  throw new Error('invalid plugin archive name')
}

Type guard

function hasValidArchiveName(file) {
  const n = (file?.name ?? '').trim()
  return n.length > 0 && n !== '.' && n !== '/' && n !== '\\'
}

Try / catch

web, server, err := pluginService.Install(file)
if err != nil && err.Error() == "invalid plugin archive name" {
    return fmt.Errorf("上传文件缺少有效文件名，请在 multipart 中指定 filename: %w", err)
}

Prevention

When building multipart bodies programmatically, always pass an explicit filename.
Validate file input has a name ending in .zip before upload.
Check proxies/gateways aren't stripping Content-Disposition filename parameters.

When it happens

Trigger: Uploading a sub-plugin archive via the sub-plugin install API with file.Filename empty, whitespace-only, '.', '/', or only separators — often from a programmatic client omitting filename in multipart/form-data.

Common situations: Custom scripts or SDK calls building multipart bodies without setting the filename part; browser edge cases where a directory was 'uploaded'; proxies stripping Content-Disposition filenames.

Related errors

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/4e325ef89849be4f. Report an issue: GitHub.