{"record":{"id":"4758424b803e6722","repo":"apache/dolphinscheduler","slug":"resource-path-resourceabsolutepath-is-not-unde","errorCode":null,"errorMessage":"Resource path: ${resourceAbsolutePath} is not under storage base directory: ${storageBaseDirectory}","messagePattern":"Resource path: (.+?) is not under storage base directory: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-storage-plugin/dolphinscheduler-storage-api/src/main/java/org/apache/dolphinscheduler/plugin/storage/api/AbstractStorageOperator.java","lineNumber":108,"sourceCode":"        // All directory should end with File.separator\n        return resourceBaseDirectory;\n    }\n\n    @Override\n    public String getStorageFileAbsolutePath(String tenantCode, String fileName) {\n        return FileUtils.concatFilePath(getStorageBaseDirectory(tenantCode, ResourceType.FILE), fileName);\n    }\n\n    protected void exceptionIfPathEmpty(String resourceAbsolutePath) {\n        if (StringUtils.isEmpty(resourceAbsolutePath)) {\n            throw new IllegalArgumentException(\"Resource path should not be empty\");\n        }\n    }\n\n    protected void exceptionIfPathNotUnderStorageBaseDir(String resourceAbsolutePath) {\n        String storageBaseDirectory = getStorageBaseDirectory();\n        if (!resourceAbsolutePath.startsWith(storageBaseDirectory)) {\n            throw new IllegalArgumentException(\n                    \"Resource path: \" + resourceAbsolutePath + \" is not under storage base directory: \"\n                            + storageBaseDirectory);\n        }\n    }\n\n}\n","sourceCodeStart":90,"sourceCodeEnd":115,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-storage-plugin/dolphinscheduler-storage-api/src/main/java/org/apache/dolphinscheduler/plugin/storage/api/AbstractStorageOperator.java#L90-L115","documentation":"A containment guard in exceptionIfPathNotUnderStorageBaseDir: the resource absolute path does not begin with the resolved storage base directory, so the operation is rejected to prevent path traversal outside the tenant's storage area. The faulty input is resourceAbsolutePath (e.g. containing '..' segments, an absolute path from another root, or a stale path from before a config change); the message names both the path and the expected base directory.","triggerScenarios":"Thrown at dolphinscheduler-storage-plugin/dolphinscheduler-storage-api/src/main/java/org/apache/dolphinscheduler/plugin/storage/api/AbstractStorageOperator.java:108 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Canonicalize both paths before comparison and strip leading separators consistently","Ensure resource paths are always derived from getStorageBaseDirectory(tenantCode, type) rather than stored raw strings","If the base path config changed, migrate existing resource records to the new base directory","Reject paths containing '..' or Windows drive letters at input validation"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}