{"record":{"id":"2856c8a3e64b56bc","repo":"apache/seatunnel","slug":"python-source-allowlist-entry-must-be-an-absolute","errorCode":null,"errorMessage":"Python source allowlist entry must be an absolute path: {}","messagePattern":"Python source allowlist entry must be an absolute path: (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-python/src/main/java/org/apache/seatunnel/connectors/seatunnel/python/source/PythonSourceExecutionPolicy.java","lineNumber":89,"sourceCode":"    }\n\n    private static List<Path> parseAllowedExecutables() {\n        String rawAllowlist = System.getProperty(PYTHON_ALLOWED_EXECUTABLES_PROPERTY, \"\");\n        if (rawAllowlist.trim().isEmpty()) {\n            throw new IllegalStateException(\n                    \"Server property \"\n                            + PYTHON_ALLOWED_EXECUTABLES_PROPERTY\n                            + \" must contain at least one absolute executable path\");\n        }\n        Set<Path> allowedExecutables = new LinkedHashSet<>();\n        for (String rawEntry : rawAllowlist.split(\",\")) {\n            String entry = rawEntry.trim();\n            if (entry.isEmpty()) {\n                continue;\n            }\n            Path path = Paths.get(entry);\n            if (!path.isAbsolute()) {\n                throw new IllegalStateException(\n                        \"Python source allowlist entry must be an absolute path: \" + entry);\n            }\n            allowedExecutables.add(normalize(path));\n        }\n        if (allowedExecutables.isEmpty()) {\n            throw new IllegalStateException(\n                    \"Server property \"\n                            + PYTHON_ALLOWED_EXECUTABLES_PROPERTY\n                            + \" does not contain a usable absolute path\");\n        }\n        return new ArrayList<>(allowedExecutables);\n    }\n\n    private static Path resolveConfiguredExecutable(String configuredExecutable)\n            throws IOException {\n        Path configuredPath = Paths.get(configuredExecutable);\n        Path resolvedPath;\n        if (configuredPath.isAbsolute()) {","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-python/src/main/java/org/apache/seatunnel/connectors/seatunnel/python/source/PythonSourceExecutionPolicy.java#L71-L107","documentation":"Thrown while parsing the python.allowed.executables allowlist when one comma-separated entry is a relative path (e.g. 'python3' or './venv/bin/python'). The security policy only accepts absolute interpreter paths so that every worker resolves the exact same binary.","triggerScenarios":"Setting the system property to a value containing a relative path segment, e.g. -Dpython.allowed.executables=python3 or /usr/bin/python3,myenv/bin/python","commonSituations":"Typing a bare command name (python3) into the allowlist; using './...' or '~' paths; an env-var expansion producing a relative value; mixing the allowlist syntax with the python.executable config, which does allow bare commands.","solutions":["Replace each entry in the allowlist with an absolute path: python3 -> /usr/bin/python3","Resolve ambiguous entries with: which python3 or readlink -f $(which python3)","Expand ~ to the full home directory path; shell expansion does not happen for system properties"],"exampleFix":"// before\n-Dpython.allowed.executables=python3,/opt/venv/bin/python\n// after\n-Dpython.allowed.executables=/usr/bin/python3,/opt/venv/bin/python","handlingStrategy":"validation","validationCode":"for (String e : System.getProperty(\"python.allowed.executables\",\"\").split(\",\")) {\n    if (!e.trim().isEmpty() && !java.nio.file.Paths.get(e.trim()).isAbsolute())\n        throw new IllegalStateException(\"Not absolute: \" + e);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always list interpreters as absolute paths in the allowlist","Resolve command names with which/readlink before adding them","Keep a shared, reviewed allowlist value across all workers"],"tags":["python","configuration","path","security"],"backgroundTag":"invalid-argument-value","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}