{"record":{"id":"066900127f622118","repo":"quarkusio/quarkus","slug":"specified-path-can-not-contain-or-path-w","errorCode":null,"errorMessage":"Specified path can not contain '..' or '%'. Path was ","messagePattern":"Specified path can not contain '\\.\\.' or '%'\\. Path was ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/deployment/src/main/java/io/quarkus/deployment/util/UriNormalizationUtil.java","lineNumber":42,"sourceCode":"     * <li>{@code toUri(\"foo/\", false)} will return a URI with an empty path {@literal foo}</li>\n     * </ul>\n     *\n     *\n     * @param path String to convert into a URI\n     * @param trailingSlash true if resulting URI must end with a '/'\n     * @throws IllegalArgumentException if the path contains invalid characters or path segments.\n     */\n    public static URI toURI(String path, boolean trailingSlash) {\n        try {\n            // replace inbound // with /\n            path = path.replaceAll(\"//\", \"/\");\n            // remove trailing slash if result shouldn't have one\n            if (!trailingSlash && path.endsWith(\"/\")) {\n                path = path.substring(0, path.length() - 1);\n            }\n\n            if (path.contains(\"..\") || path.contains(\"%\")) {\n                throw new IllegalArgumentException(\"Specified path can not contain '..' or '%'. Path was \" + path);\n            }\n            URI uri = new URI(path).normalize();\n            if (uri.getPath().equals(\"\")) {\n                return trailingSlash ? new URI(\"/\") : new URI(\"\");\n            } else if (trailingSlash && !path.endsWith(\"/\")) {\n                uri = new URI(uri.getPath() + \"/\");\n            }\n            return uri;\n        } catch (URISyntaxException e) {\n            throw new IllegalArgumentException(\"Specified path is an invalid URI. Path was \" + path, e);\n        }\n    }\n\n    /**\n     * Resolve a string path against a URI base. The specified path can not contain\n     * relative {@literal ..} segments or {@literal %} characters.\n     *\n     * Relative paths will be resolved against the specified base URI.","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/core/deployment/src/main/java/io/quarkus/deployment/util/UriNormalizationUtil.java#L24-L60","documentation":"UriNormalizationUtil.toURI sanitizes root paths used for HTTP routes. Paths containing '..' (path traversal) or '%' (would be double-decoded) are rejected with this IllegalArgumentException to guarantee the configured route roots are safe and canonical.","triggerScenarios":"Configuring quarkus.http.root-path, quarkus.http.non-application-root-path, swagger/ui paths, or calling normalizeWithBase/segmentUri with a value containing '..' or '%'.","commonSituations":"Typos or copy-pasted paths like /api/../management; attempts to escape the application root in configuration; environment-variable-driven path config that includes encoded characters (%2F etc.).","solutions":["Remove '..' segments; specify a plain absolute path like /api or / instead.","Remove or unescape '%' characters — configure the decoded value, not a percent-encoded one.","Resolve the intended logical path by hand and set the canonical result in configuration.","Validate externalized config values (env vars) before they reach Quarkus config."],"exampleFix":"// before\nquarkus.http.root-path=/api/../management\n// after\nquarkus.http.root-path=/management","handlingStrategy":"validation","validationCode":"static void validateRootPath(String path) {\n    if (path == null || path.contains(\"..\") || path.contains(\"%\"))\n        throw new IllegalArgumentException(\"Route root must not contain '..' or '%': \" + path);\n}","typeGuard":null,"tryCatchPattern":"try { startApp(); } catch (IllegalArgumentException e) { if (e.getMessage().startsWith(\"Specified path can not contain\")) { /* fix root-path config value */ } else throw e; }","preventionTips":["Validate quarkus.http.root-path and related path properties at deploy time","Do not use env-interpolated values that may contain '..' or encoded characters","Keep route roots simple absolute paths like /api"],"tags":["configuration","uri","path-traversal"],"backgroundTag":"invalid-config-path","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}