{"record":{"id":"16478737b942640b","repo":"peass-ng/PEASS-ng","slug":"invalid-subpath","errorCode":null,"errorMessage":"Invalid Subpath","messagePattern":"Invalid Subpath","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Filesystem/DirectoryInfo Class/DirectoryInfo.CreateSubdirectoryCore.cs","lineNumber":52,"sourceCode":"      /// Any and all directories specified in path are created, unless some part of path is invalid.\n      /// The path parameter specifies a directory path, not a file path.\n      /// If the subdirectory already exists, this method does nothing.\n      /// </remarks>\n      /// <param name=\"path\">The specified path. This cannot be a different disk volume or Universal Naming Convention (UNC) name.</param>\n      /// <param name=\"templatePath\">The path of the directory to use as a template when creating the new directory.</param>\n      /// <param name=\"directorySecurity\">The <see cref=\"DirectorySecurity\"/> security to apply.</param>\n      /// <param name=\"compress\">When <c>true</c> compresses the directory using NTFS compression.</param>\n      [SecurityCritical]\n      private DirectoryInfo CreateSubdirectoryCore(string path, string templatePath, ObjectSecurity directorySecurity, bool compress)\n      {\n         var pathLp = Path.CombineCore(false, LongFullName, path);\n\n         var templatePathLp = null == templatePath ? null : Path.GetExtendedLengthPathCore(Transaction, templatePath, PathFormat.RelativePath, GetFullPathOptions.TrimEnd | GetFullPathOptions.RemoveTrailingDirectorySeparator);\n\n\n         if (string.Compare(LongFullName, 0, pathLp, 0, LongFullName.Length, StringComparison.OrdinalIgnoreCase) != 0)\n\n            throw new ArgumentException(Resources.Invalid_Subpath, \"path\");\n\n\n         return Directory.CreateDirectoryCore(false, Transaction, pathLp, templatePathLp, directorySecurity, compress, PathFormat.LongFullPath);\n      }\n   }\n}\n","sourceCodeStart":34,"sourceCodeEnd":59,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Filesystem/DirectoryInfo Class/DirectoryInfo.CreateSubdirectoryCore.cs#L34-L59","documentation":"AlphaFS throws this ArgumentException when a subdirectory path passed to CreateSubdirectory (via CreateSubdirectoryCore) is not located underneath the current DirectoryInfo instance. The comparison is done on the long-path forms (LongFullName vs pathLp), case-insensitively, comparing only the parent-length prefix; a mismatch means the target is not a descendant of this directory.","triggerScenarios":"Calling DirectoryInfo.CreateSubdirectory with a path such as an absolute path on another drive (e.g. dir on C:\\Work creating D:\\Temp), a sibling path like ..\\Other, or any path whose extended/long-path normalized form (from Path.GetExtendedLengthPathCore) does not begin with the directory's LongFullName.","commonSituations":"Joining user-supplied or config-supplied output paths to a working directory that escapes it via '..' or a different drive letter; mixing short (8.3) names, relative paths, or UNC vs drive-letter forms so the normalized prefix no longer matches.","solutions":["Ensure the target subdirectory path is relative and stays inside the DirectoryInfo instance (no leading '..' escapes, same drive).","Compute the target by combining the directory's FullName with a relative name: dir.CreateSubdirectory(Path.Combine(dir.FullName, \"child\")).","If an outside path is intended, use Directory.CreateDirectory(path) instead of DirectoryInfo.CreateSubdirectory.","Normalize casing/drive-letter and remove relative segments before calling so the long-path prefix comparison succeeds."],"exampleFix":"// before\ndrive.CreateSubdirectory(\"D:\\\\Temp\\\\out\"); // ArgumentException: Invalid Subpath\n// after\nDirectory.CreateDirectory(\"D:\\\\Temp\\\\out\"); // target is outside the current directory","handlingStrategy":"validation","validationCode":"static bool IsValidSubpath(DirectoryInfo dir, string subPath)\n{\n    if (string.IsNullOrWhiteSpace(subPath)) return false;\n    string full = Path.GetFullPath(Path.Combine(dir.FullName, subPath));\n    string parent = Path.GetFullPath(dir.FullName);\n    return full.StartsWith(parent, StringComparison.OrdinalIgnoreCase)\n        && !string.Equals(full, parent, StringComparison.OrdinalIgnoreCase);\n}\n// call only if IsValidSubpath(dir, subPath)","typeGuard":"static bool IsSubDirectory(DirectoryInfo dir, string candidate)\n{\n    var full = Path.GetFullPath(candidate);\n    var baseP = Path.GetFullPath(dir.FullName);\n    return full.StartsWith(baseP.TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase);\n}","tryCatchPattern":"try { dir.CreateSubdirectory(subPath); }\ncatch (ArgumentException ex) when (ex.ParamName == \"path\")\n{\n    // not a subpath of dir: fall back to Directory.CreateDirectory\n    Directory.CreateDirectory(subPath);\n}","preventionTips":["Always derive subdirectory paths from dir.FullName, never mix in unrelated absolute paths","Reject or resolve '..' segments from user input before calling CreateSubdirectory","Keep source and target on the same drive/volume","Use Directory.CreateDirectory for arbitrary paths outside the directory"],"tags":["arguments","path","argumentexception"],"backgroundTag":"invalid-subpath","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}