{"record":{"id":"47342a880e9896ff","repo":"gofiber/fiber","slug":"errinvalidpath","errorCode":"ErrInvalidPath","errorMessage":"invalid path","messagePattern":"invalid path","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"middleware/static/static.go","lineNumber":23,"sourceCode":"\t\"errors\"\n\t\"fmt\"\n\t\"io/fs\"\n\t\"net/url\"\n\t\"os\"\n\tpathpkg \"path\"\n\t\"path/filepath\"\n\t\"slices\"\n\t\"strconv\"\n\t\"strings\"\n\t\"sync\"\n\n\t\"github.com/gofiber/utils/v2\"\n\t\"github.com/valyala/fasthttp\"\n\n\t\"github.com/gofiber/fiber/v3\"\n)\n\nvar ErrInvalidPath = errors.New(\"invalid path\")\n\nconst invalidPathSentinel = \"/__fiber_invalid__\"\n\nfunc bytesToPathString(p []byte) string {\n\tif bytes.IndexByte(p, '\\\\') >= 0 {\n\t\tb := make([]byte, len(p))\n\t\tcopy(b, p)\n\t\tfor i := range b {\n\t\t\tif b[i] == '\\\\' {\n\t\t\t\tb[i] = '/'\n\t\t\t}\n\t\t}\n\t\treturn utils.UnsafeString(b)\n\t}\n\n\treturn utils.UnsafeString(p)\n}\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/gofiber/fiber/blob/a105acad6c1e4576a77f01e02973f67e962bb58d/middleware/static/static.go#L5-L41","documentation":"The static middleware sanitizes request paths and uses invalidPathSentinel (\"/__fiber_invalid__\") as a marker for paths that cannot be safely resolved to a filesystem entry. When the cleaned path equals this sentinel (or otherwise fails validation), ErrInvalidPath is returned, preventing path-traversal and serving of unexpected resources.","triggerScenarios":"A request whose path, after cleaning/decoding, equals the invalid sentinel or otherwise cannot be normalized into a servable filesystem path (e.g., control characters, malformed percent-encoding, null bytes).","commonSituations":"URL-encoded path traversal attempts; clients sending raw bytes; misbehaving reverse proxies that forward un-normalized paths; symbolic-link or root-escape attempts.","solutions":["Normalize and validate paths at the edge (reverse proxy / middleware) before they reach the static handler.","Return 400 for requests containing control characters or invalid percent-encoding.","Keep the static handler rooted at a dedicated prefix and disable directory listing if not needed."],"exampleFix":"// before\napp.Use(\"/files\", static.New(\"./uploads\"))\n\n// after\napp.Use(\"/files\", func(c fiber.Ctx) error {\n    if strings.ContainsAny(c.Path(), \"\\x00\") {\n        return fiber.NewError(fiber.StatusBadRequest)\n    }\n    return c.Next()\n})\napp.Use(\"/files\", static.New(\"./uploads\"))","handlingStrategy":"validation","validationCode":"p := c.Path()\nif strings.ContainsAny(p, \"\\x00\\r\\n\") || !utf8.ValidString(p) {\n    return fiber.NewError(fiber.StatusBadRequest, \"malformed path\")\n}","typeGuard":"func isServablePath(p string) bool {\n    return p != \"\" && !strings.ContainsAny(p, \"\\x00\\r\\n\") && utf8.ValidString(p)\n}","tryCatchPattern":null,"preventionTips":["Reject control characters and invalid percent-encoding at the edge.","Keep static handlers on dedicated prefixes.","Disable directory listing unless explicitly needed."],"tags":["static","path","security","path-traversal"],"backgroundTag":null,"analyzedSha":"a105acad6c1e4576a77f01e02973f67e962bb58d","analyzedAt":"2026-08-11T17:33:26.942Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}