apache/dolphinscheduler · error · IllegalArgumentException

Resource path: ${resourceAbsolutePath} is not under storage

Error message

Resource path: ${resourceAbsolutePath} is not under storage base directory: ${storageBaseDirectory}

What it means

A containment guard in exceptionIfPathNotUnderStorageBaseDir: the resource absolute path does not begin with the resolved storage base directory, so the operation is rejected to prevent path traversal outside the tenant's storage area. The faulty input is resourceAbsolutePath (e.g. containing '..' segments, an absolute path from another root, or a stale path from before a config change); the message names both the path and the expected base directory.

Source

Thrown at dolphinscheduler-storage-plugin/dolphinscheduler-storage-api/src/main/java/org/apache/dolphinscheduler/plugin/storage/api/AbstractStorageOperator.java:108

        // All directory should end with File.separator
        return resourceBaseDirectory;
    }

    @Override
    public String getStorageFileAbsolutePath(String tenantCode, String fileName) {
        return FileUtils.concatFilePath(getStorageBaseDirectory(tenantCode, ResourceType.FILE), fileName);
    }

    protected void exceptionIfPathEmpty(String resourceAbsolutePath) {
        if (StringUtils.isEmpty(resourceAbsolutePath)) {
            throw new IllegalArgumentException("Resource path should not be empty");
        }
    }

    protected void exceptionIfPathNotUnderStorageBaseDir(String resourceAbsolutePath) {
        String storageBaseDirectory = getStorageBaseDirectory();
        if (!resourceAbsolutePath.startsWith(storageBaseDirectory)) {
            throw new IllegalArgumentException(
                    "Resource path: " + resourceAbsolutePath + " is not under storage base directory: "
                            + storageBaseDirectory);
        }
    }

}

View on GitHub (pinned to 02eac45a1b)

Solutions

  1. Canonicalize both paths before comparison and strip leading separators consistently
  2. Ensure resource paths are always derived from getStorageBaseDirectory(tenantCode, type) rather than stored raw strings
  3. If the base path config changed, migrate existing resource records to the new base directory
  4. Reject paths containing '..' or Windows drive letters at input validation
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at dolphinscheduler-storage-plugin/dolphinscheduler-storage-api/src/main/java/org/apache/dolphinscheduler/plugin/storage/api/AbstractStorageOperator.java:108 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/4758424b803e6722. Report an issue: GitHub.