{"record":{"id":"4772323edb1c3431","repo":"mastra-ai/mastra","slug":"invalid-route-path-path-path-cannot-contain-477232","errorCode":null,"errorMessage":"Invalid route path: \"${path}\". Path cannot contain '..', '?', or '#'","messagePattern":"Invalid route path: \"(.+?)\"\\. Path cannot contain '\\.\\.', '\\?', or '#'","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/server/src/server/utils.ts","lineNumber":39,"sourceCode":"  return standardSchemaToJSONSchema(standardSchema);\n}\n\n/**\n * Normalizes a route path to ensure consistent formatting.\n * - Removes leading/trailing whitespace\n * - Validates no path traversal (..), query strings (?), or fragments (#)\n * - Collapses multiple consecutive slashes\n * - Removes trailing slashes\n * - Ensures leading slash (unless empty)\n *\n * @param path - The route path to normalize\n * @returns The normalized path (empty string for root paths)\n * @throws Error if path contains invalid characters\n */\nexport function normalizeRoutePath(path: string): string {\n  let normalized = path.trim();\n  if (normalized.includes('..') || normalized.includes('?') || normalized.includes('#')) {\n    throw new Error(`Invalid route path: \"${path}\". Path cannot contain '..', '?', or '#'`);\n  }\n  normalized = normalized.replace(/\\/+/g, '/');\n  if (normalized === '/' || normalized === '') {\n    return '';\n  }\n  if (normalized.endsWith('/')) {\n    normalized = normalized.slice(0, -1);\n  }\n  if (!normalized.startsWith('/')) {\n    normalized = `/${normalized}`;\n  }\n  return normalized;\n}\n\nconst DEFAULT_STORED_RESOURCE_SCOPE_METADATA_KEY = 'mastra.resourceId';\n\nexport type StoredResourceScope = {\n  metadataKey: string;","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/utils.ts#L21-L57","documentation":"normalizeRoutePath validates and canonicalizes route paths, collapsing duplicate slashes and normalizing the root path. Paths containing '..', '?', or '#' are rejected outright because they enable path traversal or are not valid route path components. The original (not trimmed) path is included in the error message.","triggerScenarios":"Passing a route path containing '..' (traversal), a query string ('?'), or a fragment ('#') to normalizeRoutePath, which is invoked when registering API routes or building server route tables.","commonSituations":"Accidentally concatenating a query string into a route path (e.g. '/agents?id=1' instead of passing query params separately); building paths from user input or template strings that include '..'; copy-pasting URLs (with fragments) into route definitions.","solutions":["Remove '?...' query strings from the path and accept query params via the request handler instead","Remove any '#...' fragment from the path — fragments are client-side only and never part of a route","Resolve '..' segments statically (use absolute, literal paths like '/api/agents')","Sanitize any dynamic input before interpolating it into route paths"],"exampleFix":"// before\nregisterApiRoute(`/api/agents?version=${v}`, handler)\n// after\nregisterApiRoute('/api/agents', handler) // pass ?version= in the actual request query","handlingStrategy":"validation","validationCode":"if (/[?#]/.test(routePath) || routePath.includes('..')) {\n  throw new Error('Rejecting unsafe route path');\n}","typeGuard":"const safePath = (p: unknown): p is string =>\n  typeof p === 'string' && !p.includes('..') && !/[?#]/.test(p);","tryCatchPattern":null,"preventionTips":["Use constants for route paths","Never interpolate query strings or fragments into paths","Validate paths from external config files at load time"],"tags":["routes","validation","path-traversal"],"backgroundTag":"invalid-route-path","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}