FyroxEngine/Fyrox · error

Path may not start with ..

Error message

Path may not start with ..

What it means

ResourceIo::normalize_path (via Path::components) rejects relative paths that begin with a ParentDir (`..`) when there is no existing component to pop. Since the path being normalized is relative (absolute paths/prefixes are rejected earlier), a leading `..` has nothing to pop, so the function panics. This guards against path escapes from the resource base directory.

Solutions

1. Remove or resolve the leading `..` before passing the path (make it relative to the resource base).
2. Validate input paths and reject/rewrite any that start with `..`.
3. If the target truly lives outside the resource root, relocate it under the root or use an absolute path through the file system API instead.

Example fix

// before
let path = Path::new("../textures/rock.png");
resource_manager.request::<Texture>(path); // panics
// after
let path = Path::new("textures/rock.png"); // relative to the resource base
resource_manager.request::<Texture>(path);

fn is_safe_relative_path(p: &Path) -> bool {
    !p.is_absolute()
        && !p.components().any(|c| matches!(c, std::path::Component::ParentDir))
        && p.components().next().is_some()
}

fn resource_path_ok(p: &Path) -> bool { !p.starts_with("..") && p.is_relative() }

When it happens

Trigger: Calling canonicalize_path/normalize_path with a relative path like "../assets/tile.png" or "..\\foo.png"; building resource paths by string concatenation that produce leading `..`; passing user-supplied resource paths unvalidated.

Common situations: Mods/plugins referencing resources outside the base directory; portable save/config files that embed `..` paths; path traversal attempts through user input.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Resource type mismatch. Expected
• Registering empty path.
• Animation pool must be empty on load!
• Cast to failed!
• An object at index must be returned to a pool it was taken…

AI-assisted analysis of FyroxEngine/Fyrox@76c91aad8e (2026-09-10). Data as JSON: /api/errors/a01927f944cdf60f. Report an issue: GitHub.

Appendix: source

Thrown at fyrox-resource/src/io.rs:217

/// and replace \ with /. There is no requirement that any part of the path actually exists.
/// The path "." is returned if the resulting path would otherwise be empty.
///
/// Because the file system is not accessed, all paths must be relative to the project root,
/// and this function will return an error if the path tries to go outside of it, such as by .. directories
/// or by being an absolute path.
pub fn normalize_path(path: impl AsRef<Path>) -> Result<PathBuf, FileError> {
    let components = path.as_ref().components();
    let mut ret = PathBuf::new();

    for component in components {
        match component {
            Component::Prefix(..) | Component::RootDir => {
                return Err(format!("Invalid path: {:?}", path.as_ref()).into());
            }
            Component::CurDir => {}
            Component::ParentDir => {
                if !ret.pop() {
                    panic!("Path may not start with ..");
                }
            }
            Component::Normal(c) => {
                ret.push(c);
            }
        }
    }

    if ret.as_os_str().is_empty() {
        return Ok(".".into());
    }

    // The resource registry uses normalized paths with `/` slashes, and this step is needed
    // mostly on Windows which uses `\` slashes.
    Ok(replace_slashes(ret))
}

impl ResourceIo for FsResourceIo {

View on GitHub (pinned to 76c91aad8e)