HelloZeroNet/ZeroNet · error · Exception

Invalid cors path: %s

Error message

Invalid cors path: %s

What it means

Validation error thrown by getCorsPath when the inner_path does not match the expected 'cors-<site_address>/<path>' format. The input at fault is a malformed cors inner_path whose address part is not a 26-35 character alphanumeric site address, so no CORS target can be extracted.

Source

Thrown at plugins/Cors/CorsPlugin.py:20

import html
import copy
import os
import gevent

from Plugin import PluginManager
from Translate import Translate


plugin_dir = os.path.dirname(__file__)

if "_" not in locals():
    _ = Translate(plugin_dir + "/languages/")


def getCorsPath(site, inner_path):
    match = re.match("^cors-([A-Za-z0-9]{26,35})/(.*)", inner_path)
    if not match:
        raise Exception("Invalid cors path: %s" % inner_path)
    cors_address = match.group(1)
    cors_inner_path = match.group(2)

    if not "Cors:%s" % cors_address in site.settings["permissions"]:
        raise Exception("This site has no permission to access site %s" % cors_address)

    return cors_address, cors_inner_path


@PluginManager.registerTo("UiWebsocket")
class UiWebsocketPlugin(object):
    def hasSitePermission(self, address, cmd=None):
        if super(UiWebsocketPlugin, self).hasSitePermission(address, cmd=cmd):
            return True

        allowed_commands = [
            "fileGet", "fileList", "dirList", "fileRules", "optionalFileInfo",
            "fileQuery", "dbQuery", "userGetSettings", "siteInfo"

View on GitHub (pinned to 454c0b2e7e)

Solutions

1. Fix the caller to build inner_path as 'cors-<address>/<inner_path>' with a valid site address
2. Verify the address embedded in the cors path is not truncated or URL-encoded before calling
3. Catch the exception in corsFuncWrapper/parsePath and return a clear error to the client

When it happens

Trigger: Thrown at plugins/Cors/CorsPlugin.py:20 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of HelloZeroNet/ZeroNet@454c0b2e7e (2026-09-02). Data as JSON: /api/errors/0ddbdb11f1cd111b. Report an issue: GitHub.