larksuite/cli · error

%s must not be empty

Error message

%s must not be empty

What it means

ResourceName validates a caller-supplied resource identifier (message IDs, app IDs, etc.) used in URL paths. An empty value cannot form a valid endpoint, so it is rejected with the flag name embedded for clarity. This is the first of several defenses that keep user input from altering the API endpoint.

Source

Thrown at internal/validate/resource.go:29

	"github.com/larksuite/cli/internal/charcheck"
)

// unsafeResourceChars matches URL-special characters, control characters,
// and percent signs (to prevent %2e%2e encoding bypass).
var unsafeResourceChars = regexp.MustCompile(`[?#%\x00-\x1f\x7f]`)

// ResourceName validates an API resource identifier (messageId, fileToken, etc.)
// before it is interpolated into a URL path via fmt.Sprintf. It rejects path
// traversal (..), URL metacharacters (?#%), percent-encoded bypasses (%2e%2e),
// control characters, and dangerous Unicode.
//
// Without this check, an input like "../admin" or "?evil=true" in a message ID
// would alter the API endpoint the request is sent to. Works alongside
// EncodePathSegment for defense-in-depth.
func ResourceName(name, flagName string) error {
	if name == "" {
		return fmt.Errorf("%s must not be empty", flagName)
	}
	for _, seg := range strings.Split(name, "/") {
		if seg == ".." {
			return fmt.Errorf("%s must not contain '..' path traversal", flagName)
		}
	}
	if unsafeResourceChars.MatchString(name) {
		return fmt.Errorf("%s contains invalid characters", flagName)
	}
	for _, r := range name {
		if charcheck.IsDangerousUnicode(r) {
			return fmt.Errorf("%s contains dangerous Unicode characters", flagName)
		}
	}
	return nil
}

// EncodePathSegment percent-encodes user input for safe use as a single URL path

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Supply the required ID flag explicitly.
2. Verify the variable or env var feeding the flag is actually populated before invoking the command.
3. Check earlier pipeline steps that should have produced the ID and failed silently.
4. Run the command with --help to confirm the exact flag name shown in the error.

Example fix

// before
lark-cli im message get --message-id "$MSG_ID"   # MSG_ID empty
// after
: "${MSG_ID:?MSG_ID must be set}"
lark-cli im message get --message-id "$MSG_ID"

if id == "" {
    return fmt.Errorf("--message-id is required")
}

if err := cmd.Run(); err != nil {
    if strings.Contains(err.Error(), "must not be empty") {
        return fmt.Errorf("supply the required resource ID: %w", err)
    }
    return err
}

When it happens

Trigger: validate.ResourceName called with name == "" from buildServiceRequest, SetHelper/UnsetHelper, validateMemberAppID, or anonymous call sites — typically when a required ID flag is unset or expands to an empty value.

Common situations: Forgetting a required --message-id/--app-id flag, environment variables that expand to empty strings, upstream command output that produced no ID, scripting pipelines where a lookup returned nothing.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• %s contains invalid characters
• Missing sheet_id for sheet {title!r}
• Invalid cell reference: {cell_ref}
• Invalid A1 range endpoint: {endpoint}
• Invalid A1 range: {range_ref}

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/2145ea0cfb002ace. Report an issue: GitHub.