{"record":{"id":"1cb7ae5dc8ac879e","repo":"microsoft/aspire","slug":"the-path-path-configured-with-methodname-is-outside-the-deno","errorCode":null,"errorMessage":"The path '{path}' configured with {methodName} is outside the Deno application directory, so it is not part of the generated Dockerfile's build context. Move the file inside the application directory or provide a custom Dockerfile.","messagePattern":"The path '(.+?)' configured with (.+?) is outside the Deno application directory, so it is not part of the generated Dockerfile's build context\\. Move the file inside the application directory or provide a custom Dockerfile\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.JavaScript/DenoHostingExtensions.cs","lineNumber":1006,"sourceCode":"    /// <summary>\n    /// Rejects a configured path that would resolve outside the generated Dockerfile's build context.\n    /// </summary>\n    /// <remarks>\n    /// Validation uses the same platform-independent normalizer as the generated Dockerfile. Both <c>/</c> and\n    /// <c>\\</c> are treated as separators so Windows rooted and UNC paths cannot become absolute only after they\n    /// are emitted into the Linux container. Traversal is resolved by depth: <c>config/../deno.json</c> stays\n    /// inside the context and normalizes to <c>deno.json</c>, while <c>config/../../outside.json</c> escapes it.\n    /// </remarks>\n    private static void ThrowIfPathEscapesDenoBuildContext(string? path, string methodName)\n    {\n        if (string.IsNullOrEmpty(path))\n        {\n            return;\n        }\n\n        if (!TryNormalizeDenoContainerRelativePath(path, out _))\n        {\n            throw new InvalidOperationException($\"The path '{path}' configured with {methodName} is outside the Deno application directory, so it is not part of the generated Dockerfile's build context. Move the file inside the application directory or provide a custom Dockerfile.\");\n        }\n    }\n\n    private static bool TryNormalizeDenoContainerRelativePath(string path, out string normalizedPath)\n    {\n        var containerPath = path.Replace('\\\\', '/');\n        if (containerPath.StartsWith('/') || IsWindowsDriveQualifiedPath(containerPath))\n        {\n            normalizedPath = string.Empty;\n            return false;\n        }\n\n        // Deno accepts remote import maps. They are not build-context paths and must retain the URI's double slash.\n        if (Uri.TryCreate(containerPath, UriKind.Absolute, out var uri) &&\n            (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps))\n        {\n            normalizedPath = containerPath;\n            return true;","sourceCodeStart":988,"sourceCodeEnd":1024,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.JavaScript/DenoHostingExtensions.cs#L988-L1024","documentation":"The generated Deno Dockerfile's build context is the Deno application directory. A configured path (config file, etc.) that is absolute or escapes that directory would never be copied into the image, breaking `deno cache` and the entrypoint, so the library throws at build time instead.","triggerScenarios":"Calling WithDenoConfig(path) (or another WithDeno* method feeding ThrowIfPathEscapesDenoBuildContext via ThrowIfUnsupportedDenoDenoDockerfileOptions) with an absolute path, a ../-style relative path, or a Windows drive-qualified path outside the app directory.","commonSituations":"Sharing a single deno.json from a solution-level folder (\"../../deno.json\"); using an absolute path on CI; referencing a config that lives in a sibling project directory.","solutions":["Move the config/script file inside the Deno application directory and reference it relatively.","Copy the file into the app directory during build/publish before the Dockerfile is generated.","Provide a custom Dockerfile whose build context includes the external file."],"exampleFix":"// before\n.WithDenoConfig(\"../shared/deno.json\")\n// after\n.WithDenoConfig(\"deno.json\") // file copied into the app directory","handlingStrategy":"validation","validationCode":"// confirm the path stays inside the app directory before configuring Deno\nvar full = Path.GetFullPath(Path.Combine(appDirectory, configuredPath));\nif (!full.StartsWith(Path.GetFullPath(appDirectory), StringComparison.Ordinal))\n{\n    throw new ArgumentException($\"Path '{configuredPath}' must resolve inside the Deno app directory.\");\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    app.WithDenoConfig(\"deno.json\");\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"outside the Deno application directory\"))\n{\n    // copy the file into the app directory or use a custom Dockerfile\n}","preventionTips":["Keep all Deno config and script files inside the application directory.","Avoid absolute and ../-style paths in WithDeno* calls, especially on CI machines.","Copy shared solution-level configs into each app directory rather than referencing them across directories."],"tags":["deno","dockerfile","path","build-context"],"backgroundTag":"path-traversal-blocked","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}