OpenAPITools/openapi-generator · error · IllegalArgumentException

Template location must be constrained to template directory.

Error message

Template location must be constrained to template directory.

What it means

Guard inside TemplateManager.getFullTemplateFile(): after resolving the template, it rejects a name that is null or contains '..' to block path traversal outside the template directory. Note the ordering quirk: resolution happens first, so a null name actually throws TemplateNotFoundException earlier (StringUtils.isEmpty(null)); in practice this guard fires for names containing '..'. It is a security check, not a 'file missing' check.

Source

Thrown at modules/openapi-generator/src/main/java/org/openapitools/codegen/TemplateManager.java:70

            TemplatePathLocator[] templateLoaders) {
        this.options = options;
        this.engineAdapter = engineAdapter;
        this.templateLoaders = templateLoaders;
    }

    private String getFullTemplateFile(String name) {
        String template = Arrays.stream(this.templateLoaders)
                .map(i -> i.getFullTemplatePath(name))
                .filter(Objects::nonNull)
                .findFirst()
                .orElse("");

        if (StringUtils.isEmpty(template)) {
            throw new TemplateNotFoundException(name);
        }

        if (name == null || name.contains("..")) {
            throw new IllegalArgumentException("Template location must be constrained to template directory.");
        }

        return template;
    }

    /**
     * returns the template content by name
     *
     * @param name the template name (e.g. model.mustache)
     * @return the contents of that template
     */
    @Override
    public String getFullTemplateContents(String name) {
        String fullPath = getFullTemplateFile(name);
        return templateContentCache.computeIfAbsent(fullPath, this::readTemplate);
    }

    /**

View on GitHub (pinned to fcec517be3)

Solutions

1. Remove '..' segments from the template name — reference templates by their name relative to a configured template directory or classpath root.
2. Copy the needed template into your template directory and reference it by plain filename.
3. Sanitize any user-supplied template name before passing it to generation APIs (reject/normalize '..').

Example fix

// before
String name = "../JavaSpring/model.mustache";
// after
String name = "model.mustache"; // put the file in the -t template dir instead

boolean safeTemplateName(String name) {
    return name != null && !name.contains("..") && !name.startsWith("/");
}

Catch IllegalArgumentException and reject the input at your API boundary; treat as untrusted input, log the attempt.

When it happens

Trigger: A template name like '../templates/model.mustache' or 'foo/../../model.mustache' passed through generator settings or a custom generator that builds names from user input; template name concatenated with a path that itself contains '..'.

Common situations: Custom generators constructing template paths from additionalProperties values; CI configurations passing relative paths with '..' as template names; attempts to reuse a template from another generator's directory via traversal.

Related errors

• Target files must be generated within the output directory;
• %s Input: `%s`. Error: %s
• {name}
• can't load template {name}
• Could not process model '{name}'.Please make sure that your

AI-assisted analysis of OpenAPITools/openapi-generator@fcec517be3 (2026-08-22). Data as JSON: /api/errors/e1742c03a4810e59. Report an issue: GitHub.