alibaba/nacos · error · NacosApiException

PARAMETER_VALIDATE_ERROR

PARAMETER_VALIDATE_ERROR

Error message

filePath is invalid

What it means

SkillsFileQueryForm guards against path traversal: filePath is rejected if it starts with '/' or '\', or contains '..'. A match throws PARAMETER_VALIDATE_ERROR (HTTP 400). Note the '..' check is a substring test, so even legitimate names containing two consecutive dots are rejected.

Source

Thrown at ai-registry-adaptor/src/main/java/com/alibaba/nacos/airegistry/form/SkillsFileQueryForm.java:55

    @Override
    public void validate() throws NacosApiException {
        if (StringUtils.isBlank(namespaceId)) {
            throw new NacosApiException(NacosApiException.INVALID_PARAM,
                ErrorCode.PARAMETER_MISSING,
                "namespaceId is required");
        }
        if (StringUtils.isBlank(skillName)) {
            throw new NacosApiException(NacosApiException.INVALID_PARAM,
                ErrorCode.PARAMETER_MISSING,
                "skillName is required");
        }
        if (StringUtils.isBlank(filePath)) {
            throw new NacosApiException(NacosApiException.INVALID_PARAM,
                ErrorCode.PARAMETER_MISSING,
                "filePath is required");
        }
        if (filePath.startsWith("/") || filePath.startsWith("\\") || filePath.contains("..")) {
            throw new NacosApiException(NacosApiException.INVALID_PARAM,
                ErrorCode.PARAMETER_VALIDATE_ERROR,
                "filePath is invalid");
        }
    }
    
    public String getNamespaceId() {
        return namespaceId;
    }
    
    public void setNamespaceId(String namespaceId) {
        this.namespaceId = namespaceId;
    }
    
    public String getSkillName() {
        return skillName;
    }
    
    public void setSkillName(String skillName) {

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Pass a relative path that does not start with '/' or '\' and contains no '..', e.g. README.md or docs/guide.md.
2. Strip leading slashes from client-provided paths before sending.
3. If a real filename contains '..', rename it so the substring check passes.

Example fix

// before
GET /skill-file?...&filePath=../config/settings.yml

// after
GET /skill-file?...&filePath=config/settings.yml

// Reject unsafe paths before the call
String p = filePath == null ? "" : filePath.trim();
if (p.isEmpty() || p.startsWith("/") || p.startsWith("\\") || p.contains("..")) {
    throw new IllegalArgumentException("filePath is invalid: " + filePath);
}

When it happens

Trigger: Calling the skill-file endpoint with ?filePath=/etc/passwd, ?filePath=../secret, ?filePath=..\config, or any value starting with a slash/backslash or containing '..'.

Common situations: Supplying an absolute path; using relative traversal to escape the skill package; a filename that legitimately contains '..' (e.g. 'my..file.txt') which is also caught by the substring rule.

Related errors

• Path traversal detected: {path}
• SERVER_ERROR
• PARAMETER_MISSING
• PARAMETER_MISSING
• PARAMETER_MISSING

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/8cff9cb468eb2499. Report an issue: GitHub.