larksuite/cli · error

empty pattern

Error message

empty pattern

What it means

validateGlob rejects an empty glob pattern outright with 'empty pattern' before consulting doublestar. An empty pattern is meaningless, so the library treats it as a configuration error rather than silently accepting a no-op rule.

Source

Thrown at internal/cmdpolicy/validate.go:69

		}
	}
	for _, g := range r.Deny {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid deny glob %q: %w", g, err)
		}
	}
	return nil
}

// validateGlob rejects malformed doublestar patterns. doublestar.Match
// returns an error for unbalanced brackets / bad escape sequences; that
// error path is the canonical signal for "this pattern is not valid".
//
// We probe with an empty string -- the goal is to exercise the parser,
// not to compute a match.
func validateGlob(g string) error {
	if g == "" {
		return fmt.Errorf("empty pattern")
	}
	if _, err := doublestar.Match(g, ""); err != nil {
		return err
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Remove the empty entry from the allow/deny list.
2. If the value comes from a variable, ensure it is set and non-empty before rendering.
3. If no patterns are needed, delete the whole allow or deny key.

Example fix

// before
allow:
  - "docs/*"
  - ""
// after
allow:
  - "docs/*"

for _, g := range append(append([]string{}, rule.Allow...), rule.Deny...) {
	if strings.TrimSpace(g) == "" {
		return fmt.Errorf("empty glob entry")
	}
}

func hasEmptyPattern(list []string) bool {
	for _, g := range list { if g == "" { return true } }
	return false
}

When it happens

Trigger: ValidateRule sees an Allow or Deny entry that is the empty string "", typically from a YAML list with a bare '-' item, a generator emitting empty list items, or an unset variable substituted into the policy.

Common situations: Config generators emitting empty entries; YAML like 'allow:\n -' producing an empty-string item; template rendering where an unset variable left an empty pattern.

Related errors

• invalid allow glob %q: %w
• invalid deny glob %q: %w
• invalid identities entry %q: must be 'user' or 'bot'
• Invalid column: {column!r}
• Invalid column index: {index}

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/65b87a4cb195193f. Report an issue: GitHub.