{"record":{"id":"303c4e49b8462a4e","repo":"FlowiseAI/Flowise","slug":"invalid-path-path-traversal-detected-in-resolved","errorCode":null,"errorMessage":"Invalid path: path traversal detected in resolved path","messagePattern":"Invalid path: path traversal detected in resolved path","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/components/src/validator.ts","lineNumber":268,"sourceCode":"    }\n    if (/^\\\\\\\\\\?\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Extended-length paths are not allowed')\n    }\n\n    // Resolve to absolute path\n    // If path is relative, resolve it relative to the .flowise directory (safe default)\n    // If path is already absolute, keep it as-is\n    let resolvedPath: string\n    if (path.isAbsolute(basePath)) {\n        resolvedPath = path.resolve(basePath)\n    } else {\n        // Relative paths are resolved within the .flowise directory for safety\n        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))\n    }\n\n    // Verify the resolved path doesn't contain '..' after resolution\n    if (resolvedPath.includes('..')) {\n        throw new Error('Invalid path: path traversal detected in resolved path')\n    }\n\n    // Check if resolved path is within allowed directories\n    const allowedDirs = getAllowedVectorStoreBaseDirs()\n    const isWithinAllowedDir = allowedDirs.some((allowedDir) => {\n        const normalizedResolved = normalizePlatformPath(resolvedPath)\n        const normalizedAllowed = normalizePlatformPath(allowedDir)\n        return normalizedResolved === normalizedAllowed || normalizedResolved.startsWith(normalizedAllowed + path.sep)\n    })\n\n    if (!isWithinAllowedDir) {\n        throw new Error(\n            `Invalid path: path must be within allowed directories (${allowedDirs.join(', ')}). ` + `Attempted path: ${resolvedPath}`\n        )\n    }\n\n    return resolvedPath\n}","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L250-L286","documentation":"Thrown by validateVectorStorePath (packages/components/src/validator.ts:268) when, after path.resolve(), the resulting absolute path still contains a '..' segment. path.resolve() normally collapses '..', so reaching this branch means an unusual input shape (e.g. a path composed such that resolve leaves a trailing/edge-case '..') slipped past the earlier substring check.","triggerScenarios":"An absolute path is supplied where path.resolve does not fully normalize '..' — extremely rare; typically indicates a malformed absolute path or a path ending in '..' after a non-normalizable prefix.","commonSituations":"Hand-crafted or programmatically concatenated absolute paths; platform-specific path quirks; effectively an internal-safety net rather than a routine config error.","solutions":["Run path.normalize() on the candidate path yourself before passing it in.","Rebuild the path from trusted segments instead of string concatenation.","Use a relative name under ~/.flowise to avoid the absolute-path code branch."],"exampleFix":"// before\nnodeParams.basePath = someAbsPath   // resolves with a residual '..'\n\n// after\nconst { path } = require('path')\nnodeParams.basePath = path.normalize(someAbsPath)","handlingStrategy":"validation","validationCode":"const { normalize } = require('path');\nconst candidate = normalize(String(basePath ?? ''));\nif (candidate.includes('..')) throw new Error('path still contains .. after normalize; rebuild it');","typeGuard":"const isNormalized = (p: unknown): p is string => typeof p === 'string' && !normalize(p).includes('..');","tryCatchPattern":"try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /resolved path/.test(e.message)) { basePath = normalize(basePath) } else throw e }","preventionTips":["Always path.normalize() user paths before submitting them.","Build paths from trusted segments via path.join rather than string concatenation.","Prefer relative names to avoid the absolute-path edge branch."],"tags":["path-traversal","security","validation","filesystem","edge-case","vector-store","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}