{"record":{"id":"0c4315ca0ceec550","repo":"docker/cli","slug":"unexpected-in-path","errorCode":null,"errorMessage":"unexpected '\\\\' in path","messagePattern":"unexpected '\\\\\\\\' in path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/store/store.go","lineNumber":379,"sourceCode":"\t}\n\tswitch importContentType {\n\tcase zipType:\n\t\treturn importZip(name, s, r)\n\tdefault:\n\t\t// Assume it's a TAR (TAR does not have a \"magic number\")\n\t\treturn importTar(name, s, r)\n\t}\n}\n\nfunc isValidFilePath(p string) error {\n\tif p != metaFile && !strings.HasPrefix(p, \"tls/\") {\n\t\treturn errors.New(\"unexpected context file\")\n\t}\n\tif path.Clean(p) != p {\n\t\treturn errors.New(\"unexpected path format\")\n\t}\n\tif strings.Contains(p, `\\`) {\n\t\treturn errors.New(`unexpected '\\' in path`)\n\t}\n\treturn nil\n}\n\nfunc importTar(name string, s Writer, reader io.Reader) error {\n\ttr := tar.NewReader(&limitedReader{R: reader, N: maxAllowedFileSizeToImport})\n\ttlsData := ContextTLSData{\n\t\tEndpoints: map[string]EndpointTLSData{},\n\t}\n\tvar importedMetaFile bool\n\tfor {\n\t\thdr, err := tr.Next()\n\t\tif err == io.EOF {\n\t\t\tbreak\n\t\t}\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/store/store.go#L361-L397","documentation":"Returned by isValidFilePath during context Import when a tar/zip archive entry's name contains a backslash character. Docker context archives must use POSIX-style forward-slash paths; a backslash indicates a Windows-style path or a crafted entry that path.Clean would not normalize, so the importer rejects it defensively before extracting.","triggerScenarios":"Calling store.Import (docker context import) with an archive produced on Windows by a tool that emitted backslash separators, or a hand-crafted/malicious archive where an entry name contains '\\'. The check at store.go:378 fires after the path-format and prefix validations pass.","commonSituations":"Zipping a context directory on Windows with built-in tools that preserve native separators; archiving files where the TLS endpoint subfolder name accidentally includes a backslash; transferring a context between Windows and Linux hosts.","solutions":["Re-export the context on the original host with docker context export (it always emits forward slashes) and import that archive instead.","Inspect the archive with tar -tvf / unzip -l and rewrite any entry names containing backslashes to forward slashes using a repacking tool.","Avoid creating context archives manually; only use docker context export/import round-trips."],"exampleFix":"// before: manual zip on Windows emits 'tls\\docker\\cert.pem'\n// after: repack with forward-slash paths\n//   tar -tf ctx.tar | sed 's/\\\\/\\//g'  # verify, then repack\n//   or simply: docker context export <src> && docker context import <dst> < ctx.dockercontext","handlingStrategy":"validation","validationCode":"// Validate archive entries before calling store.Import\nfunc validateArchiveEntries(r io.Reader) error {\n\ttr := tar.NewReader(r)\n\tfor {\n\t\thdr, err := tr.Next()\n\t\tif err == io.EOF { break }\n\t\tif err != nil { return err }\n\t\tif strings.Contains(hdr.Name, `\\`) {\n\t\t\treturn fmt.Errorf(\"entry %q contains a backslash\", hdr.Name)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only import archives produced by docker context export.","On Windows, use docker context export rather than OS-level zip tools to guarantee forward-slash paths.","Inspect archive entry names with tar -tvf / unzip -l before importing into a context store."],"tags":["context","import","archive","windows","path-traversal"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}