BigPizzaV3/CodexPlusPlus · error · anyhow::Error

Backup source database is not an allowed local storage path

Error message

Backup source database is not an allowed local storage path

What it means

Thrown by backup_source_db when the canonicalized source database path is not in the caller-provided allowed_db_paths set. This is a path-confinement guard for restores: a backup record cannot pull rows from databases outside the sanctioned local-storage locations; the offending input is the source_db path embedded in the (untrusted) backup record.

Source

Thrown at crates/codex-plus-data/src/storage.rs:929

) -> anyhow::Result<PathBuf> {
    let source_db = backup["source_db"]
        .as_str()
        .filter(|path| !path.trim().is_empty())
        .map(PathBuf::from)
        .unwrap_or_else(|| fallback_db_path.to_path_buf());
    if !source_db.is_file() {
        anyhow::bail!(
            "Backup source database not found: {}",
            source_db.to_string_lossy()
        );
    }
    let source_db = fs::canonicalize(source_db)?;
    let allowed = allowed_db_paths
        .iter()
        .filter_map(|path| fs::canonicalize(path).ok())
        .any(|path| path == source_db);
    if !allowed {
        anyhow::bail!("Backup source database is not an allowed local storage path");
    }
    Ok(source_db)
}

fn schema_kind(db: &Connection) -> anyhow::Result<Option<SchemaKind>> {
    if has_table(db, "sessions")? && has_columns(db, "sessions", &["id", "title"])? {
        if has_table(db, "messages")? && !has_columns(db, "messages", &["session_id"])? {
            return Ok(None);
        }
        return Ok(Some(SchemaKind::GenericSessions));
    }
    if has_table(db, "threads")? && has_columns(db, "threads", &["id", "title", "rollout_path"])? {
        return Ok(Some(SchemaKind::CodexThreads));
    }
    if has_table(db, "automation_runs")? && has_columns(db, "automation_runs", &["thread_id"])? {
        return Ok(Some(SchemaKind::CodexAutomationRuns));
    }
    Ok(None)

View on GitHub (pinned to f2074595a2)

Solutions

1. 确认备份是在当前机器、当前数据库路径下创建的
2. 若数据库位置合法迁移，更新 allowed_db_paths 候选列表
3. 不要手工导入来源不明的备份 token
4. 在生成备份的机器上执行 undo

When it happens

Trigger: Thrown at crates/codex-plus-data/src/storage.rs:929 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BigPizzaV3/CodexPlusPlus@f2074595a2 (2026-08-23). Data as JSON: /api/errors/441794687b127613. Report an issue: GitHub.