alibaba/open-code-review · error

file path %q is outside repository

Error message

file path %q is outside repository

What it means

Path-containment guard: after joining the repo root with the relative path, the result (or its symlink-resolved parent) lies outside the repository. This blocks path traversal like ../../etc/passwd from reading arbitrary files as 'workspace diffs'.

Source

Thrown at internal/diff/workspace_file.go:25

	"fmt"
	"os"
	"path/filepath"

	"github.com/alibaba/open-code-review/internal/pathutil"
)

func readWorkspaceFileForDiff(repoDir, relPath string) ([]byte, error) {
	repoRoot, err := pathutil.CanonicalPath(repoDir)
	if err != nil {
		return nil, fmt.Errorf("resolve repository path %q: %w", repoDir, err)
	}
	if filepath.IsAbs(relPath) {
		return nil, fmt.Errorf("file path %q must be relative, not absolute", relPath)
	}

	fullPath := filepath.Join(repoRoot, relPath)
	if !pathutil.WithinBase(repoRoot, fullPath) {
		return nil, fmt.Errorf("file path %q is outside repository", relPath)
	}

	parent, err := filepath.EvalSymlinks(filepath.Dir(fullPath))
	if err != nil {
		return nil, fmt.Errorf("resolve parent path for %q: %w", relPath, err)
	}
	if !pathutil.WithinBase(repoRoot, parent) {
		return nil, fmt.Errorf("file path %q is outside repository", relPath)
	}

	info, err := os.Lstat(fullPath)
	if err != nil {
		return nil, fmt.Errorf("stat file %q: %w", relPath, err)
	}
	if info.IsDir() {
		return nil, fmt.Errorf("file path %q is a directory", relPath)
	}
	if info.Mode()&os.ModeSymlink != 0 {

View on GitHub (pinned to 5cf97d0d15)

Solutions

1. Verify the path stays inside the repository after joining with the repo root
2. Do not use '..' or symlink tricks to escape the repo root; the check runs both before and after symlink resolution
3. If the file genuinely lives outside the repo, it is not reviewable as a workspace change

When it happens

Trigger: Thrown at internal/diff/workspace_file.go:25 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/f073ba23d0ab8170. Report an issue: GitHub.