Tencent/WeKnora · error

path traversal denied: path is outside base directory

Error message

path traversal denied: path is outside base directory

What it means

Containment guard in SafePathUnderBase: after normalizing both paths, the file path is not equal to and does not lie under the base directory (prefix check with the path separator), so a path traversal such as ../.. was attempted and is denied.

Source

Thrown at internal/utils/security.go:123

}

// SafePathUnderBase 校验 filePath 是否落在 baseDir 下，防止路径遍历（如 ../../）。
// 返回规范化的绝对路径；若路径逃逸出 baseDir 则返回错误。
func SafePathUnderBase(baseDir, filePath string) (string, error) {
	if baseDir == "" || filePath == "" {
		return "", fmt.Errorf("baseDir and filePath cannot be empty")
	}
	absBase, err := filepath.Abs(filepath.Clean(baseDir))
	if err != nil {
		return "", fmt.Errorf("invalid base dir: %w", err)
	}
	absPath, err := filepath.Abs(filepath.Clean(filePath))
	if err != nil {
		return "", fmt.Errorf("invalid file path: %w", err)
	}
	sep := string(filepath.Separator)
	if absPath != absBase && !strings.HasPrefix(absPath, absBase+sep) {
		return "", fmt.Errorf("path traversal denied: path is outside base directory")
	}
	return absPath, nil
}

// SafeFileName 校验并返回安全的“仅文件名”部分，防止路径遍历。
// 仅保留最后一个路径成分，禁止 ".."、空名或仅含点，用于 SaveBytes 等场景。
func SafeFileName(fileName string) (string, error) {
	if fileName == "" {
		return "", fmt.Errorf("fileName cannot be empty")
	}
	base := filepath.Base(filepath.Clean(fileName))
	if base == "" || base == "." || base == ".." {
		return "", fmt.Errorf("invalid fileName: path traversal or empty name")
	}
	if strings.Contains(base, "..") {
		return "", fmt.Errorf("invalid fileName: contains path traversal")
	}
	if len(base) > 255 {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Keep requested paths inside baseDir; resolve user input against the base instead of concatenating raw input
2. Log the traversal attempt for security review
3. Reject rather than sanitize ambiguous paths

When it happens

Trigger: Thrown at internal/utils/security.go:123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/0e726806ceadf47d. Report an issue: GitHub.