{"record":{"id":"4397af13e9fa600c","repo":"jdx/mise","slug":"brew-cask-invalid-kind-field-path-4397af","errorCode":null,"errorMessage":"brew-cask:{}: invalid {kind} {field} path {}","messagePattern":"brew-cask:(.+?): invalid (.+?) (.+?) path (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/packages/brew/cask/artifacts.rs","lineNumber":1083,"sourceCode":"            \"brew-cask:{}: unsupported {kind} {field} metadata format\",\n            cask.token\n        )\n    })?;\n    let base = match object.get(\"base\").and_then(Value::as_str) {\n        Some(\"staged_path\") => FlightPathBase::StagedPath,\n        Some(base) => bail!(\n            \"brew-cask:{}: unsupported {kind} {field} base {}\",\n            cask.token,\n            base\n        ),\n        None => bail!(\"brew-cask:{}: unsupported {kind} {field} base\", cask.token),\n    };\n    let path = object\n        .get(\"path\")\n        .and_then(Value::as_str)\n        .ok_or_else(|| eyre!(\"brew-cask:{}: unsupported {kind} {field} path\", cask.token))?;\n    if validate_flight_relative_path(path).is_err() {\n        bail!(\n            \"brew-cask:{}: invalid {kind} {field} path {}\",\n            cask.token,\n            path\n        )\n    }\n    Ok(FlightPath {\n        base,\n        path: path.to_string(),\n    })\n}\n\npub(super) fn collect_pkg_receipt_ids(value: &Value, pkg_ids: &mut Vec<String>) {\n    let Some(object) = value.as_object() else {\n        return;\n    };\n    let Some(metadata) = object.get(\"uninstall\") else {\n        return;\n    };","sourceCodeStart":1065,"sourceCodeEnd":1101,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/packages/brew/cask/artifacts.rs#L1065-L1101","documentation":"After parsing a cask move/rename path (base + path), the path string is validated by validate_flight_relative_path: it must be a safe relative path (no absolute paths, no `..` traversal components when based on staged_path). This error fires when the path value fails that validation.","triggerScenarios":"A cask path like \"/Applications/Foo.app\" (absolute) or \"../Foo.app\" (parent-directory traversal), or a non-sensical relative path, passed in a move/rename path object.","commonSituations":"Casks moving staged files to absolute destinations (which Homebrew handles differently), malicious or mis-edited casks attempting traversal outside the staging area, and paths with stray leading slashes or `.` components the validator rejects.","solutions":["Change the path to a relative path within the staged cask directory (no leading `/`, no `..` segments).","If an absolute destination is truly needed, express it via the appropriate base + relative path rather than an absolute string.","Inspect the cask for accidental path mangling (spaces, escaped slashes) and correct it.","Treat this as a red flag for untrusted taps: verify the cask source before trusting its move targets."],"exampleFix":"// before\n{ \"base\": \"staged_path\", \"path\": \"/Applications/Foo.app\" }\n// after\n{ \"base\": \"staged_path\", \"path\": \"Foo.app\" }","handlingStrategy":"validation","validationCode":"function isSafeRelativePath(p) {\n  return typeof p === \"string\" && !p.startsWith(\"/\") && !p.split(\"/\").includes(\"..\");\n}","typeGuard":"function isSafeFlightPath(p: string): p is string {\n  return !p.startsWith(\"/\") && !p.split(\"/\").includes(\"..\");\n}","tryCatchPattern":"try {\n  installCask(token);\n} catch (e) {\n  if (String(e).includes(\"invalid\") && String(e).includes(\"path\")) {\n    console.warn(`Cask ${token} move path failed validation — refusing untrusted path`);\n  } else throw e;\n}","preventionTips":["Author move paths as plain relative paths inside the staged directory","Reject absolute or '..'-containing paths during cask review","Be extra careful with untrusted taps: path validation is a traversal guard"],"tags":["homebrew","cask","parsing","path-validation","security"],"backgroundTag":"invalid-argument-format","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}