apache/dolphinscheduler · error · ServiceException

ILLEGAL_RESOURCE_PATH

ILLEGAL_RESOURCE_PATH

Error message

ILLEGAL_RESOURCE_PATH

What it means

CreateDirectoryRequestTransformer.getDirectoryAbsolutePath throws a ServiceException with status ILLEGAL_RESOURCE_PATH when the supplied parentDirectoryName is not under the requesting user's resource root path, refusing to build a child path outside the user's allowed tree.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/validator/resource/CreateDirectoryRequestTransformer.java:83

    }

    private String getDirectoryAbsolutePath(CreateDirectoryRequest createDirectoryRequest) {
        String tenantCode = tenantDao.queryOptionalById(createDirectoryRequest.getLoginUser().getTenantId())
                .orElseThrow(() -> new ServiceException(Status.CURRENT_LOGIN_USER_TENANT_NOT_EXIST))
                .getTenantCode();
        String userResRootPath = storageOperator.getStorageBaseDirectory(tenantCode, createDirectoryRequest.getType());
        String parentDirectoryName = createDirectoryRequest.getParentAbsoluteDirectory();
        String directoryName = createDirectoryRequest.getDirectoryName();

        // If the parent directory is / then will transform to userResRootPath
        // This only happens when the front-end go into the resource page first
        // todo: we need to change the front-end logic to avoid this
        if (parentDirectoryName.equals("/")) {
            return FileUtils.concatFilePath(userResRootPath, directoryName);
        }

        if (!StringUtils.startsWith(parentDirectoryName, userResRootPath)) {
            throw new ServiceException(Status.ILLEGAL_RESOURCE_PATH, parentDirectoryName);
        }
        return FileUtils.concatFilePath(parentDirectoryName, directoryName);
    }
}

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Send a parent path that begins with the user's resource root (e.g. '/tenantA/resources'), or send '/' to create at the root level.
2. Re-fetch the directory tree from the API instead of using cached/typed paths.
3. Verify the logged-in user's tenant matches the tenant prefix in the parent path.
4. If this fires from the bundled UI, upgrade — the code notes the front-end logic needs updating to avoid it.

Example fix

// before: parent outside the user's root
createDirectory(parentDirectoryName = "/otherTenant/resources", directoryName = "jobs");
// after
createDirectory(parentDirectoryName = "/myTenant/resources", directoryName = "jobs");

String root = "/" + tenantCode + "/resources"; if (parentDirectoryName != null && !parentDirectoryName.equals("/") && !parentDirectoryName.startsWith(root)) { throw new IllegalArgumentException("Parent outside user root: " + parentDirectoryName); }

boolean isLegalParent(String parent, String root) { return "/".equals(parent) || (parent != null && parent.startsWith(root)); }

try { createDirectory(...); } catch (ServiceException e) { if ("ILLEGAL_RESOURCE_PATH".equals(e.getCode())) { /* rebuild parent from user root and retry */ } else { throw e; } }

When it happens

Trigger: Creating a directory where the parent path sent by the client does not start with the user's root (userResRootPath, i.e. '/<tenantCode>/resources'); typically only '/' (root) is special-cased and allowed.

Common situations: Tampered/malformed front-end requests; stale clients caching old root paths after tenant or storage-config changes; scripts calling the REST API with absolute paths outside the user's resource tree.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• The path is not a directory: ${resourceAbsolutePath}
• The path is not a file: ${fileAbsolutePath}
• 20016
• ILLEGAL_RESOURCE_PATH
• Invalidated resource path: ${resourceAbsolutePath}

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/463cb85826321d75. Report an issue: GitHub.