{"record":{"id":"39ec802473063cbe","repo":"microsoft/semantic-kernel","slug":"the-operation-path-resolves-to-request-path-w","errorCode":null,"errorMessage":"The operation path resolves to '{request.path}', which is outside the configured server base path '{base_path}'.","messagePattern":"The operation path resolves to '(.+?)', which is outside the configured server base path '(.+?)'\\.","errorType":"exception","errorClass":"FunctionExecutionException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/connectors/openapi_plugin/models/rest_api_operation.py","lineNumber":262,"sourceCode":"        server = urlparse(server_url)\n        request = urlparse(request_url)\n\n        if (request.scheme, request.username, request.password, request.hostname, request.port) != (\n            server.scheme,\n            server.username,\n            server.password,\n            server.hostname,\n            server.port,\n        ):\n            raise FunctionExecutionException(\n                f\"The operation path resolves to '{request.scheme}://{request.netloc}', which does not match \"\n                f\"the configured server '{server.scheme}://{server.netloc}'.\"\n            )\n\n        # get_server_url guarantees a trailing slash, so the server base path always ends with \"/\".\n        base_path = server.path\n        if request.path != base_path.rstrip(\"/\") and not request.path.startswith(base_path):\n            raise FunctionExecutionException(\n                f\"The operation path resolves to '{request.path}', which is outside the configured server \"\n                f\"base path '{base_path}'.\"\n            )\n\n    def get_server_url(self, server_url_override=None, api_host_url=None, arguments=None):\n        \"\"\"Get the server URL for the operation.\"\"\"\n        if arguments is None:\n            arguments = {}\n\n        # Prioritize server_url_override\n        if (\n            server_url_override is not None\n            and isinstance(server_url_override, (ParseResult, ParseResultBytes))\n            and server_url_override.geturl() != b\"\"\n        ):\n            server_url_string = server_url_override.geturl()\n        elif server_url_override is not None and isinstance(server_url_override, str) and server_url_override != \"\":\n            server_url_string = server_url_override","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/openapi_plugin/models/rest_api_operation.py#L244-L280","documentation":"The second part of `_ensure_request_target_matches_server`: even when scheme/host/port match, the request path must stay within the server's base path. If the resolved request path neither equals the base path (sans trailing slash) nor starts with it, this FunctionExecutionException is raised. This prevents path traversal beyond the server's base directory even when the host is correct.","triggerScenarios":"The operation path, after joining with the server URL, resolves outside the server's base path. For example server base is `/api/v1/` but the resolved request path is `/admin/users`.","commonSituations":"An operation path starts with `..` that bypasses the host check but escapes the base path. A server base path is configured but an operation path is designed for a different base. Misconfigured server URL with a base path component.","solutions":["Ensure operation paths are within the server's configured base path.","Correct the server URL to include the proper base path, or adjust the operation paths to be relative to it.","Review the OpenAPI spec for paths that legitimately fall outside the server base and restructure accordingly."],"exampleFix":"// before (server base /api/v1/ but operation resolves to /admin)\nserver_url = \"https://api.example.com/api/v1/\"\n// after (ensure operation paths stay under the base)\nserver_url = \"https://api.example.com/api/v1/\"\n# operation path should be relative, e.g. \"users\" not \"/admin/users\"","handlingStrategy":"validation","validationCode":"from urllib.parse import urlparse\ndef validate_base_path(server_url: str, request_url: str):\n    s, r = urlparse(server_url), urlparse(request_url)\n    base_path = s.path\n    if r.path != base_path.rstrip('/') and not r.path.startswith(base_path):\n        raise ValueError(f\"Request path '{r.path}' is outside server base path '{base_path}'\")","typeGuard":null,"tryCatchPattern":"try:\n    result = await api.my_operation(**args)\nexcept FunctionExecutionException as e:\n    if \"outside the configured server base path\" in str(e):\n        # ensure operation paths stay within the server base path\n        ...","preventionTips":["Ensure operation paths are relative and within the server's base path.","Configure the server URL with the correct base path.","Review spec paths for any that escape the base directory."],"tags":["openapi","rest-api","security","path-traversal","url","semantic-kernel"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}