{"record":{"id":"14746297882dbb5c","repo":"denoland/deno","slug":"package-name-must-not-contain-dot-path-segments","errorCode":null,"errorMessage":"package name must not contain dot path segments","messagePattern":"package name must not contain dot path segments","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/registry.rs","lineNumber":246,"sourceCode":"  // Keep the explicit path-safety checks below even if the JSR grammar changes.\n  let reference = JsrPackageReqReference::from_str(&format!(\"jsr:{name}@*\"))\n    .map_err(|_| {\n      deno_core::anyhow::anyhow!(\n        \"package name must use the '@<scope>/<package>' format\"\n      )\n    })?;\n  if reference.sub_path().is_some() {\n    bail!(\"package name must not contain additional path segments\");\n  }\n\n  let Some((scope, package)) =\n    name.strip_prefix('@').and_then(|name| name.split_once('/'))\n  else {\n    bail!(\"package name must use the '@<scope>/<package>' format\");\n  };\n  for component in [scope, package] {\n    if component == \".\" || component == \"..\" {\n      bail!(\"package name must not contain dot path segments\");\n    }\n    if component\n      .chars()\n      .any(|c| matches!(c, '/' | '\\\\' | '?' | '#' | '%'))\n    {\n      bail!(\"package name contains a URL path or delimiter character\");\n    }\n  }\n  Ok((scope, package))\n}\n\n/// Returns `true` if the given package version is already published to the\n/// registry.\n///\n/// Only a `200 OK` response is treated as \"already published\". A `404` (and any\n/// other non-success status) is treated as \"not published\" so that this\n/// up-front optimization never blocks a legitimate publish because of a\n/// transient registry error.","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/denoland/deno/blob/f7822238cab635a3a19f99f493f675fa81a7f9d8/cli/registry.rs#L228-L264","documentation":"`parse_package_name` path-safety check: each of the scope and package components is rejected if it is `.` or `..`. This prevents dot path segments that would escape or alias directories when the name is turned into registry URLs or file paths.","triggerScenarios":"Passing a name where scope or package is exactly `.` or `..`, such as `@scope/..`, `@./pkg`, or `@../pkg`, into `parse_package_name`.","commonSituations":"Path manipulation or string concatenation bugs that leave `.`/`..` segments in the name; trying to reference a parent/relative location through a package name, which JSR does not allow.","solutions":["Replace any `.` or `..` segment with the real scope/package identifier","Resolve the relative path in your own code first, then use the resulting concrete package name","Validate user-supplied names before calling (reject `.`/`..` components early with a clear message)"],"exampleFix":"// before\nparse_package_name(\"@my-scope/..\")?;\n// after\nparse_package_name(\"@my-scope/my-package\")?;","handlingStrategy":"validation","validationCode":"fn has_dot_segments(name: &str) -> bool {\n  name.strip_prefix('@')\n    .and_then(|r| r.split_once('/'))\n    .map(|(s, p)| s == \".\" || s == \"..\" || p == \".\" || p == \"..\")\n    .unwrap_or(true)\n}\nif has_dot_segments(name) {\n  eprintln!(\"package name components cannot be '.' or '..'\");\n  return;\n}\nlet (scope, package) = parse_package_name(name)?;","typeGuard":"fn is_safe_jsr_name(name: &str) -> bool {\n  !name.split('/').any(|c| c == \".\" || c == \"..\")\n    && name.starts_with('@')\n}","tryCatchPattern":"match parse_package_name(name) {\n  Ok((scope, package)) => /* use scope/package */,\n  Err(e) if e.to_string().contains(\"dot path segments\") => {\n    eprintln!(\"resolve relative path segments before naming the package\");\n  }\n  Err(e) => return Err(e),\n}","preventionTips":["Never build package names from file paths without normalizing `.`/`..` first","Canonicalize/resolve relative paths in your own code before deriving a name","Add dot-segment rejection to any input validator that feeds package names","Treat package names as identifiers, not paths — never use them for directory traversal"],"tags":["jsr","package-name","validation","path-traversal"],"backgroundTag":"invalid-package-name","analyzedSha":"f7822238cab635a3a19f99f493f675fa81a7f9d8","analyzedAt":"2026-08-29T08:55:39.519Z","contentChangedAt":"2026-08-29T08:55:39.519Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}