{"record":{"id":"0ddbdb11f1cd111b","repo":"HelloZeroNet/ZeroNet","slug":"invalid-cors-path-s","errorCode":null,"errorMessage":"Invalid cors path: %s","messagePattern":"Invalid cors path: (.+?)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"plugins/Cors/CorsPlugin.py","lineNumber":20,"sourceCode":"import html\nimport copy\nimport os\nimport gevent\n\nfrom Plugin import PluginManager\nfrom Translate import Translate\n\n\nplugin_dir = os.path.dirname(__file__)\n\nif \"_\" not in locals():\n    _ = Translate(plugin_dir + \"/languages/\")\n\n\ndef getCorsPath(site, inner_path):\n    match = re.match(\"^cors-([A-Za-z0-9]{26,35})/(.*)\", inner_path)\n    if not match:\n        raise Exception(\"Invalid cors path: %s\" % inner_path)\n    cors_address = match.group(1)\n    cors_inner_path = match.group(2)\n\n    if not \"Cors:%s\" % cors_address in site.settings[\"permissions\"]:\n        raise Exception(\"This site has no permission to access site %s\" % cors_address)\n\n    return cors_address, cors_inner_path\n\n\n@PluginManager.registerTo(\"UiWebsocket\")\nclass UiWebsocketPlugin(object):\n    def hasSitePermission(self, address, cmd=None):\n        if super(UiWebsocketPlugin, self).hasSitePermission(address, cmd=cmd):\n            return True\n\n        allowed_commands = [\n            \"fileGet\", \"fileList\", \"dirList\", \"fileRules\", \"optionalFileInfo\",\n            \"fileQuery\", \"dbQuery\", \"userGetSettings\", \"siteInfo\"","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/HelloZeroNet/ZeroNet/blob/454c0b2e7e000fda7000cba49027541fbf327b96/plugins/Cors/CorsPlugin.py#L2-L38","documentation":"Validation error thrown by getCorsPath when the inner_path does not match the expected 'cors-<site_address>/<path>' format. The input at fault is a malformed cors inner_path whose address part is not a 26-35 character alphanumeric site address, so no CORS target can be extracted.","triggerScenarios":"Thrown at plugins/Cors/CorsPlugin.py:20 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the caller to build inner_path as 'cors-<address>/<inner_path>' with a valid site address","Verify the address embedded in the cors path is not truncated or URL-encoded before calling","Catch the exception in corsFuncWrapper/parsePath and return a clear error to the client"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"454c0b2e7e000fda7000cba49027541fbf327b96","analyzedAt":"2026-09-02T19:46:57.278Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}