{"record":{"id":"0c3af88b44b5344d","repo":"mastra-ai/mastra","slug":"invalid-mount-path-mountpath-must-be-an-absol","errorCode":null,"errorMessage":"Invalid mount path: ${mountPath}. Must be an absolute path with alphanumeric, dash, dot, underscore, or slash characters only.","messagePattern":"Invalid mount path: (.+?)\\. Must be an absolute path with alphanumeric, dash, dot, underscore, or slash characters only\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/workspace/sandbox/local-sandbox.ts","lineNumber":63,"sourceCode":"/**\n * Directory for mount marker files used to detect config changes across restarts.\n *\n * Resolved lazily so `os.tmpdir()` is never invoked at module-load time. The\n * Agent/evals runtime (which transitively imports this module) is bundled into\n * the Studio client, where `node:os` is shimmed to an empty object and\n * `os.tmpdir` is `undefined`. Evaluating it at import time crashes Studio boot.\n * See https://github.com/mastra-ai/mastra/issues/18519.\n */\nexport function getMarkerDir(): string {\n  return path.join(os.tmpdir(), '.mastra-mounts');\n}\n\n/** Allowlist pattern for mount paths — absolute path with safe characters only. */\nconst SAFE_MOUNT_PATH = /^\\/[a-zA-Z0-9_.\\-/]+$/;\n\nfunction validateMountPath(mountPath: string): void {\n  if (!SAFE_MOUNT_PATH.test(mountPath)) {\n    throw new Error(\n      `Invalid mount path: ${mountPath}. Must be an absolute path with alphanumeric, dash, dot, underscore, or slash characters only.`,\n    );\n  }\n  const segments = mountPath.split('/').filter(Boolean);\n  if (segments.length === 0) {\n    throw new Error(`Invalid mount path: ${mountPath}. Root path \"/\" is not allowed.`);\n  }\n  if (segments.some(seg => seg === '.' || seg === '..')) {\n    throw new Error(`Invalid mount path: ${mountPath}. Path segments cannot be \".\" or \"..\".`);\n  }\n}\n\n/** Canonicalize mount path so `/data`, `/data/`, `//data` all resolve to `/data`. */\nfunction normalizeMountPath(mountPath: string): string {\n  return `/${mountPath.split('/').filter(Boolean).join('/')}`;\n}\n\n// =============================================================================","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/core/src/workspace/sandbox/local-sandbox.ts#L45-L81","documentation":"LocalSandbox validates every mount path against SAFE_MOUNT_PATH (`/^\\/[a-zA-Z0-9_.\\-/]+$/`) before mounting or unmounting. The path must be absolute and contain only safe characters — no spaces, backslashes, `~`, `:` (Windows drives), or URL-encoded segments. This prevents injection/escaping bugs in path handling.","triggerScenarios":"Calling `sandbox.mount(path)` or `sandbox.unmount(path)` with a relative path (`data`), a path with spaces (`/my data`), a Windows path (`C:\\data`), a `~` shortcut, or any character outside [a-zA-Z0-9_.-/].","commonSituations":"Using user-supplied or env-derived paths without sanitizing; developing on Windows and passing `C:\\...` paths; using `path.join` with relative segments; shell-style `~` expansion.","solutions":["Convert the path to an absolute POSIX-style path starting with `/`","Sanitize or reject paths containing characters outside [a-zA-Z0-9_.-/] before calling mount/unmount","Expand `~` and resolve relative paths yourself with `path.resolve` before passing them in"],"exampleFix":"// before\nsandbox.mount('~/my data');\n// after\nimport os from 'os';\nimport path from 'path';\nconst target = path.resolve(process.env.DATA_DIR ?? '/data');\nif (!/^\\/[a-zA-Z0-9_.\\-/]+$/.test(target)) throw new Error(`Unsafe mount path: ${target}`);\nsandbox.mount(target);","handlingStrategy":"validation","validationCode":"const SAFE_MOUNT_PATH = /^\\/[a-zA-Z0-9_.\\-/]+$/;\nexport function assertSafeMountPath(p: string) {\n  if (!SAFE_MOUNT_PATH.test(p)) throw new Error(`Invalid mount path: ${p}`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await sandbox.mount(userPath);\n} catch (err) {\n  if (/Invalid mount path/.test(String(err?.message))) {\n    throw new Error(`Configure an absolute POSIX mount path (e.g. /data); got: ${userPath}`);\n  }\n  throw err;\n}","preventionTips":["Run path.resolve and reject non-POSIX (Windows/backslash) paths at config-load time","Expand ~ and env vars yourself; never pass raw user/environment strings to mount()","Add a schema (zod regex) to your config validation for mount paths"],"tags":["validation","filesystem","mount","path"],"backgroundTag":"invalid-path-format","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}