ViewComponent/view_component · error · ViewComponent::SystemTestControllerNefariousPathError

ViewComponent SystemTest controller attempted to load a file

Error message

ViewComponent SystemTest controller attempted to load a file outside of the expected directory.

What it means

Error "ViewComponent SystemTest controller attempted to load a file outside of the expected directory." thrown in ViewComponent/view_component.

Source

Thrown at app/controllers/view_components_system_test_controller.rb:32

    def system_test_entrypoint
      render file: @path
    end

    private

    def render_not_found
      head :not_found
    end

    # Ensure that the file path is valid and doesn't target files outside
    # the expected directory (e.g. via a path traversal or symlink attack)
    def validate_file_path
      base_path = ::File.realpath(self.class.temp_dir)
      @path = ::File.realpath(params.permit(:file)[:file], base_path)
      allowed_prefix = "#{base_path}#{::File::SEPARATOR}"
      unless @path == base_path || @path.start_with?(allowed_prefix)
        raise ViewComponent::SystemTestControllerNefariousPathError
      end
    end
  end
end

View on GitHub (pinned to 9f22c36fa7)

Solutions

1. Move the file being loaded so it lives inside one of the directories listed in config.view_component.preview_paths.
2. If the file legitimately lives elsewhere, add that directory to config.view_component.preview_paths so the controller's path validation accepts it.
3. Remove any path traversal (../) segments from the requested preview path.

When it happens

Trigger: Thrown at app/controllers/view_components_system_test_controller.rb:32 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ViewComponent/view_component@9f22c36fa7 (2026-08-23). Data as JSON: /api/errors/f8d47e349e0d70ef. Report an issue: GitHub.