What causes "asset path is required" in siyuan-note/siyuan?

Check for empty/whitespace assetPath at the request boundary and return a 400.

asset path is required

Error message

asset path is required

What it means

Returned by ResolveDataAssetPath when assetPath is the empty string. ResolveDataAssetPath resolves a data-directory-relative asset path with strict traversal guards; an empty input is rejected before any path normalization. It is the first and most basic guard in the resolver.

Source

Thrown at kernel/model/assets.go:893

		sort.Slice(ret, func(i, j int) bool {
			return ret[i].Updated > ret[j].Updated
		})
	}

	if Conf.Search.Limit <= len(ret) {
		ret = ret[:Conf.Search.Limit]
	}
	return
}

func GetAssetAbsPath(relativePath string) (string, error) {
	return GetAssetAbsPathWithOpt(relativePath, false)
}

// ResolveDataAssetPath 解析 data 相对资源路径，并确保目标位于全局或普通笔记本的资源目录中。
func ResolveDataAssetPath(assetPath string) (relativePath, absPath string, err error) {
	if assetPath == "" {
		err = errors.New("asset path is required")
		return
	}

	nativePath := filepath.FromSlash(assetPath)
	if filepath.IsAbs(nativePath) || filepath.VolumeName(nativePath) != "" ||
		(len(nativePath) > 0 && os.IsPathSeparator(nativePath[0])) {
		err = fmt.Errorf("asset path must be relative to data directory: %s", assetPath)
		return
	}

	nativePath = filepath.Clean(nativePath)
	absPath = filepath.Join(util.DataDir, nativePath)
	dataRelativePath, relErr := filepath.Rel(util.DataDir, absPath)
	if relErr != nil || dataRelativePath == "." || dataRelativePath == ".." ||
		strings.HasPrefix(dataRelativePath, ".."+string(filepath.Separator)) {
		err = fmt.Errorf("asset path escapes data directory: %s", assetPath)
		return
	}

View on GitHub (pinned to 251596fc0d)

Solutions

Check for empty/whitespace assetPath at the request boundary and return a 400.
Make the field required in the request schema.

Example fix

// before
rel, abs, err := model.ResolveDataAssetPath(path)

// after
if strings.TrimSpace(path) == "" {
    return errors.New("asset path is required")
}
rel, abs, err := model.ResolveDataAssetPath(path)

Defensive patterns

Strategy: validation

Validate before calling

if strings.TrimSpace(assetPath) == "" {
    return errors.New("asset path is required")
}

Prevention

Make asset path a required field in request schemas.
Reject empty values at the API boundary with a clear 400.

When it happens

Trigger: Calling ResolveDataAssetPath(""); a caller forwarding an unvalidated query parameter; a deserialized JSON field that was omitted.

Common situations: An API endpoint accepted an optional asset path and forwarded it without checking presence; a refactor left a blank default.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/81eaf1ad0fc8d435. Report an issue: GitHub.