Kong/insomnia · error · Error

Proto path escapes temporary directory

Error message

Proto path escapes temporary directory: "${candidatePath}"

What it means

Security guard in assertWithinTempRoot: a resolved .proto file path would land outside the temporary proto directory (path traversal via crafted file or directory names), so writing the proto tree is refused to prevent arbitrary file writes.

Solutions

1. Rename proto files/directories to remove traversal segments ('..', absolute path prefixes)
2. Trust only proto directories imported through the app's normal import flow

When it happens

Trigger: Thrown at packages/insomnia/src/network/grpc/write-proto-file.node.ts:26 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/ad2e805fb751c74c. Report an issue: GitHub.

Appendix: source

Thrown at packages/insomnia/src/network/grpc/write-proto-file.node.ts:26

import { database as db } from '../../common/database';

const { isProtoDirectory } = models.protoDirectory;
const { isProtoFile } = models.protoFile;

interface WriteResult {
  filePath: string;
  dirs: string[];
}

const sanitizeName = (name: string): string => {
  const base = path.basename(name);
  return !base || base === '..' || base === '.' ? '_' : base;
};

const assertWithinTempRoot = (tempRoot: string, candidatePath: string): void => {
  const relative = path.relative(tempRoot, candidatePath);
  if (relative.startsWith('..') || path.isAbsolute(relative)) {
    throw new Error(`Proto path escapes temporary directory: "${candidatePath}"`);
  }
};

const recursiveWriteProtoDirectory = async (
  dir: ProtoDirectory,
  descendants: BaseModel[],
  currentDirPath: string,
  tempRoot: string,
): Promise<string[]> => {
  const dirPath = path.join(currentDirPath, sanitizeName(dir.name));
  assertWithinTempRoot(tempRoot, dirPath);
  fs.mkdirSync(dirPath, { recursive: true });
  // Get and write proto files
  const files = descendants.filter(isProtoFile).filter(f => f.parentId === dir._id);
  await Promise.all(
    files.map(protoFile => {
      const fullPath = path.join(dirPath, sanitizeName(protoFile.name));
      assertWithinTempRoot(tempRoot, fullPath);

View on GitHub (pinned to d9bb2b0142)