{"record":{"id":"18bd98c0d2d8fe24","repo":"docling-project/docling","slug":"absolute-paths-are-not-allowed-with-local-base-pat","errorCode":null,"errorMessage":"Absolute paths are not allowed with local base_path: '{loc}'","messagePattern":"Absolute paths are not allowed with local base_path: '(.+?)'","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"docling/backend/utils/image_resource_loader.py","lineNumber":143,"sourceCode":"\n    def resolve_relative_path(self, loc: str, base_path: Optional[str]) -> str:\n        loc = loc.strip()\n\n        # Strip file:// prefix for validation as local path\n        if loc.startswith(file_prefix := \"file://\"):\n            loc = loc[len(file_prefix) :]\n\n        abs_loc = loc\n\n        if base_path:\n            if loc.startswith(\"//\"):\n                abs_loc = \"https:\" + loc\n            elif not loc.startswith((\"http://\", \"https://\", \"data:\", \"#\")):\n                if ImageResourceLoader.is_remote_url(base_path):\n                    abs_loc = urljoin(base_path, loc)\n                elif ImageResourceLoader.is_local_path(base_path):\n                    if ImageResourceLoader.is_absolute_path(loc):\n                        raise ValueError(\n                            f\"Absolute paths are not allowed with local base_path: '{loc}'\"\n                        )\n\n                    base_dir = Path(base_path).parent.resolve()\n                    resolved_path = (base_dir / loc).resolve()\n\n                    if not resolved_path.is_relative_to(base_dir):\n                        raise ValueError(\n                            f\"Path traversal blocked: '{loc}' resolves outside base directory\"\n                        )\n                    abs_loc = str(resolved_path)\n                else:\n                    raise ValueError(f\"Invalid base_path format: '{base_path}'\")\n\n        _log.debug(f\"Resolved location {loc} to {abs_loc}\")\n        return abs_loc\n\n    def create_image_ref(","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/docling-project/docling/blob/61d76f1ff3f8428065465889f7b4577da7df704c/docling/backend/utils/image_resource_loader.py#L125-L161","documentation":"ValueError raised in resolve_relative_path when base_path is a local path and the image location loc is absolute (e.g. '/etc/passwd.png' or 'C:\\\\x\\\\y.png'). With a local base, only relative references are permitted so a document cannot pull arbitrary files from the host filesystem.","triggerScenarios":"Converting an HTML/ODT file at /data/page.html whose <img src=\"/absolute/path/img.png\"> (root-relative URL) is resolved with a local base_path; is_absolute_path(loc) is true and the guard fires.","commonSituations":"Website exports where image srcs start with '/', files authored on Windows with drive-letter paths, templates rendered with server-root paths.","solutions":["Rewrite root-relative srcs to be relative to the document (strip the leading '/'), e.g. preprocess HTML to 'assets/img.png'.","If the files genuinely live at that path, pass a base_path whose directory contains them and use relative references.","Serve the document over http(s) with a proper base URL so '/' resolves via urljoin instead of the local-path branch."],"exampleFix":"# before\n<img src=\"/assets/logo.png\">  # base_path='/data/page.html' -> ValueError\n\n# after\n<img src=\"assets/logo.png\">  # resolves to /data/assets/logo.png","handlingStrategy":"validation","validationCode":"from pathlib import PurePosixPath, PureWindowsPath\ndef is_abs(p: str) -> bool:\n    return PurePosixPath(p).is_absolute() or PureWindowsPath(p).is_absolute()\nif base and is_local(base) and is_abs(src):\n    src = src.lstrip('/')  # or rewrite to a relative reference","typeGuard":null,"tryCatchPattern":"try:\n    loc = loader.resolve_relative_path(src, base)\nexcept ValueError as e:\n    if 'Absolute paths' in str(e):\n        loc = loader.resolve_relative_path(src.lstrip('/').replace('\\\\', '/'), base)\n    else:\n        raise","preventionTips":["Rewrite root-relative image srcs to document-relative paths when exporting HTML for local conversion","Never assume absolute file refs in documents are honored; localize assets first","Standardize assets under the document's directory tree"],"tags":["path-safety","images","local-files","html"],"backgroundTag":null,"analyzedSha":"61d76f1ff3f8428065465889f7b4577da7df704c","analyzedAt":"2026-08-14T23:53:18.727Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}