{"record":{"id":"0399f8394c452973","repo":"coollabsio/coolify","slug":"invalid-fieldname-contains-forbidden-character","errorCode":null,"errorMessage":"Invalid {$fieldName}: contains forbidden characters.","messagePattern":"Invalid (.+?): contains forbidden characters\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Jobs/ApplicationDeploymentJob.php","lineNumber":4676,"sourceCode":"            }\n        }\n\n        $composeFile['services'] = $services;\n        $existingSecrets = data_get($composeFile, 'secrets', []);\n        if ($existingSecrets instanceof Collection) {\n            $existingSecrets = $existingSecrets->toArray();\n        }\n        $composeFile['secrets'] = array_replace($existingSecrets, $secrets);\n\n        $this->application_deployment_queue->addLogEntry('Added build secrets configuration to docker-compose file (using environment variables).');\n\n        return $composeFile;\n    }\n\n    private function validatePathField(string $value, string $fieldName): string\n    {\n        if (! preg_match(ValidationPatterns::FILE_PATH_PATTERN, $value)) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: contains forbidden characters.\");\n        }\n        if (str_contains($value, '..')) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: path traversal detected.\");\n        }\n\n        return $value;\n    }\n\n    private function validateShellSafeCommand(string $value, string $fieldName): string\n    {\n        if (! preg_match(ValidationPatterns::SHELL_SAFE_COMMAND_PATTERN, $value)) {\n            throw new \\RuntimeException(\"Invalid {$fieldName}: contains forbidden shell characters.\");\n        }\n\n        return $value;\n    }\n\n    private function validateContainerName(string $value): string","sourceCodeStart":4658,"sourceCodeEnd":4694,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Jobs/ApplicationDeploymentJob.php#L4658-L4694","documentation":"ApplicationDeploymentJob::validatePathField() rejects values that do not match ValidationPatterns::FILE_PATH_PATTERN (/^\\/[a-zA-Z0-9._\\-\\/~@+]+$/): the path must be absolute (start with /) and contain only alphanumerics, dots, hyphens, underscores, slashes, ~, @, +. It guards path fields (e.g. dockerfile/compose locations read during deployment) before they reach the filesystem or shell commands.","triggerScenarios":"A path field consumed during deployment contains a relative path ('Dockerfile', 'src/..'), spaces, quotes, $, parentheses, or non-ASCII characters; any value not beginning with '/'.","commonSituations":"Users entering './docker' or 'docker/Dockerfile' instead of '/data/coolify/app/docker/Dockerfile'; Windows-style backslash paths; paths with spaces pasted from a terminal.","solutions":["Make the value an absolute path starting with '/', e.g. '/docker/Dockerfile' or '/app/compose.yaml'.","Remove spaces, quotes, $, backslashes, and other characters outside [A-Za-z0-9._-/~@+].","If you control the form/API, validate with ValidationPatterns::filePathRules() at save time."],"exampleFix":"# before: relative path with a space\ndockerfileLocation: 'my app/Dockerfile'\n\n# after: absolute path, allowed characters only\ndockerfileLocation: '/my-app/Dockerfile'","handlingStrategy":"validation","validationCode":"// Reject bad path values at input time\n$validated = $request->validate(\n    ValidationPatterns::filePathRules()\n    + ValidationPatterns::filePathMessages()\n);","typeGuard":"function isValidFilePath(?string $value): bool\n{\n    return blank($value) || preg_match(\\App\\Support\\ValidationPatterns::FILE_PATH_PATTERN, $value) === 1;\n}","tryCatchPattern":null,"preventionTips":["Always store absolute paths beginning with '/'.","Show the allowed character set next to path fields in the UI (alnum . - _ / ~ @ +).","Trim and normalize pasted values (remove quotes/backslashes) before saving."],"tags":["docker","deployment","file-path","validation"],"backgroundTag":"input-validation-failed","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}