{"record":{"id":"1171eec17b758b7f","repo":"stanfordnlp/CoreNLP","slug":"you-re-trying-to-delete-file-i-really-don-t-t","errorCode":null,"errorMessage":"You're trying to delete <file>! I _really_ don't think you want to do that...","messagePattern":"You're trying to delete <file>! I _really_ don't think you want to do that\\.\\.\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"src/edu/stanford/nlp/io/IOUtils.java","lineNumber":2027,"sourceCode":"  }};\n\n  /**\n   * Delete this file; or, if it is a directory, delete this directory and all its contents.\n   * This is a somewhat dangerous function to call from code, and so a few safety features have been\n   * implemented (though you should not rely on these!):\n   *\n   * <ul>\n   *   <li>Certain directories are prohibited from being removed.</li>\n   *   <li>More than 100 files cannot be removed with this function.</li>\n   *   <li>More than 10GB cannot be removed with this function.</li>\n   * </ul>\n   *\n   * @param file The file or directory to delete.\n   */\n  public static void deleteRecursively(File file) {\n    // Sanity checks\n    if (blockListPathsToRemove.contains(file.getPath())) {\n      throw new IllegalArgumentException(\"You're trying to delete \" + file + \"! I _really_ don't think you want to do that...\");\n    }\n    int count = 0;\n    long size = 0;\n    for (File f : iterFilesRecursive(file)) {\n      count += 1;\n      size += f.length();\n    }\n    if (count > 100) {\n      throw new IllegalArgumentException(\"Deleting more than 100 files; you should do this manually\");\n    }\n    if (size > 10000000000L) {  // 10 GB\n      throw new IllegalArgumentException(\"Deleting more than 10GB; you should do this manually\");\n    }\n    // Do delete\n    if (file.isDirectory()) {\n      File[] children = file.listFiles();\n      if (children != null) {\n        for (File child : children) {","sourceCodeStart":2009,"sourceCodeEnd":2045,"githubUrl":"https://github.com/stanfordnlp/CoreNLP/blob/1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a/src/edu/stanford/nlp/io/IOUtils.java#L2009-L2045","documentation":"IOUtils.deleteRecursively maintains a hardcoded blocklist (blockListPathsToRemove) of critical paths such as /, /tmp, /usr, /var and similar. If the requested File's path is on that list, it throws this IllegalArgumentException instead of deleting an entire system tree.","triggerScenarios":"Calling IOUtils.deleteRecursively(new File(\"/\")) or any path whose exact string matches an entry in blockListPathsToRemove.","commonSituations":"Accidentally passing an empty or root-relative path variable that resolved to \"/\"; cleanup code driven by a misconfigured base directory; unit tests pointing at root by mistake.","solutions":["Pass a specific application data directory, not a root or system path","Log and validate the path before calling deleteRecursively; refuse empty/relative paths","If you truly must delete a blocked path, do it manually (rm -rf) after review — do not bypass the guard"],"exampleFix":"// before\nIOUtils.deleteRecursively(new File(cleanupDir)); // cleanupDir was \"\"\n// after\nFile dir = new File(cleanupDir);\nif (cleanupDir == null || cleanupDir.isEmpty() || !dir.isAbsolute() || dir.getParentFile() == null) {\n  throw new IllegalArgumentException(\"Refusing suspicious delete path: \" + cleanupDir);\n}\nIOUtils.deleteRecursively(dir);","handlingStrategy":"validation","validationCode":"if (path == null || path.isEmpty() || !dir.isAbsolute() || dir.getParentFile() == null) throw new IllegalArgumentException(\"Unsafe delete path\");","typeGuard":null,"tryCatchPattern":"try { IOUtils.deleteRecursively(dir); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"_really_ don't think\")) { log.severe(\"Blocked delete of protected path: \" + dir); } else throw e; }","preventionTips":["Never derive delete targets from unvalidated/empty config values","Assert the delete path is under your app's dedicated data dir","Log the resolved canonical path before deleting"],"tags":["filesystem","delete","safety-guard"],"backgroundTag":"path-traversal-blocked","analyzedSha":"1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a","analyzedAt":"2026-09-10T02:24:07.274Z","contentChangedAt":"2026-09-10T02:24:07.274Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}