writeResponseBodyToFile: sourcePath is outside the allowed r

Error message

writeResponseBodyToFile: sourcePath is outside the allowed responses directory or does not end in .response

What it means

Error "writeResponseBodyToFile: sourcePath is outside the allowed responses directory or does not end in .response" thrown in Kong/insomnia.

Source

Thrown at packages/insomnia/src/main/ipc/main.ts:159

        };
      })
      .filter(file => file.type !== 'other');
  } catch (err) {
    throw new Error(`Failed to read directory: ${err}`);
  }
};

const writeResponseBodyToFile = async (
  _: unknown,
  options: { sourcePath: string; destinationPath: string; bodyCompression?: 'zip' | null },
) => {
  // Validate sourcePath is within the expected responses directory to prevent a
  // compromised renderer from using this handler to read arbitrary files on disk.
  const userdataDirectory = process.env.INSOMNIA_DATA_PATH || app.getPath('userData');
  const allowedResponsesDir = path.join(userdataDirectory, 'responses');
  const resolvedSource = path.resolve(options.sourcePath);
  if (!resolvedSource.startsWith(allowedResponsesDir + path.sep) || !resolvedSource.endsWith('.response')) {
    throw new Error(
      'writeResponseBodyToFile: sourcePath is outside the allowed responses directory or does not end in .response',
    );
  }

  try {
    const dir = path.dirname(options.destinationPath);
    await fs.promises.mkdir(dir, { recursive: true });

    await (options.bodyCompression === 'zip'
      ? pipeline(
          fs.createReadStream(options.sourcePath),
          zlib.createGunzip(),
          fs.createWriteStream(options.destinationPath),
        )
      : fs.promises.copyFile(options.sourcePath, options.destinationPath));

    return options.destinationPath;
  } catch (err) {

View on GitHub (pinned to d9bb2b0142)

When it happens

Trigger: Thrown at packages/insomnia/src/main/ipc/main.ts:159 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/404a2aca15c2849d. Report an issue: GitHub.