apache/dolphinscheduler · error · ServiceException

ILLEGAL_RESOURCE_PATH

ILLEGAL_RESOURCE_PATH

Error message

ILLEGAL_RESOURCE_PATH

What it means

AbstractResourceTransformer.getParentDirectoryAbsolutePath verifies that the parent directory supplied by the client is inside the user's resource root path (/username/resources style). If parentAbsoluteDirectory does not start with the user's root, it throws ServiceException(ILLEGAL_RESOURCE_PATH) to block resource operations that escape the user's own directory tree.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/validator/resource/AbstractResourceTransformer.java:52

    protected TenantDao tenantDao;

    protected StorageOperator storageOperator;

    protected String getParentDirectoryAbsolutePath(User loginUser, String parentAbsoluteDirectory, ResourceType type) {
        String tenantCode = tenantDao.queryOptionalById(loginUser.getTenantId())
                .orElseThrow(() -> new ServiceException(Status.CURRENT_LOGIN_USER_TENANT_NOT_EXIST))
                .getTenantCode();
        String userResRootPath = storageOperator.getStorageBaseDirectory(tenantCode, type);
        // If the parent directory is / then will transform to userResRootPath
        // This only happens when the front-end go into the resource page first
        // todo: we need to change the front-end logic to avoid this
        if (parentAbsoluteDirectory.equals("/")) {
            return userResRootPath;
        }

        if (!StringUtils.startsWith(parentAbsoluteDirectory, userResRootPath)) {
            throw new ServiceException(Status.ILLEGAL_RESOURCE_PATH, parentAbsoluteDirectory);
        }
        return parentAbsoluteDirectory;
    }
}

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Pass a parentDir that begins with the current user's resource root path (visible in the resource center UI breadcrumb).
2. Clear the frontend state / re-login so the UI sends paths belonging to the current user.
3. If integrating programmatically, compute parentDir via StorageOperator.getStorageBaseDirectory + user root rather than hardcoding.

Example fix

// before
parentDir = "/otheruser/resources";
// after
parentDir = "/alice/resources";  // starts with current user's root path

// client-side pre-check
if (!parentDir.startsWith("/" + currentUser.getUserName() + "/resources")) {
    throw new IllegalArgumentException("parentDir must be inside the user's resource root");
}

function isWithinUserRoot(path, userRoot) {
  return typeof path === 'string' && path.startsWith(userRoot.replace(/\/$/, '') + '/');
}

try {
    // move/copy/rename resource
} catch (ServiceException e) {
    if (e.getCode() == Status.ILLEGAL_RESOURCE_PATH.getCode()) {
        // recompute parentDir from the resource-center listing API
    } else throw e;
}

When it happens

Trigger: Calling resource move/copy/rename/create-directory APIs with a parentDir parameter that points outside the logged-in user's resource root (e.g. a path rooted at another tenant's directory or an absolute path like /etc).

Common situations: Frontend caches stale paths belonging to a previous logged-in user; manual API calls hardcoding a shared/global base directory; version changes where the storage root layout changed (the source notes the front-end logic still needs fixing).

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalidated resource path: ${resourceAbsolutePath}
• The path is not a directory: ${resourceAbsolutePath}
• The path is not a file: ${fileAbsolutePath}
• ILLEGAL_RESOURCE_PATH
• Can not find valid resource by name %s

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/f52910c8523f4606. Report an issue: GitHub.