{"record":{"id":"50013765b7c28dd7","repo":"nats-io/nats-server","slug":"js-err-generic","errorCode":"JS_ERR_GENERIC","errorMessage":"account name can not contain path separators","messagePattern":"account name can not contain path separators","errorType":"validation","errorClass":"JSStreamGeneralError","httpStatus":null,"severity":"error","filePath":"server/jetstream_api.go","lineNumber":3151,"sourceCode":"\t\ts.Warnf(badAPIRequestT, msg)\n\t\treturn\n\t}\n\tif acc != s.SystemAccount() {\n\t\treturn\n\t}\n\n\tjs := s.getJetStream()\n\tif js == nil {\n\t\treturn\n\t}\n\n\taccName := tokenAt(subject, 5)\n\n\tvar resp = JSApiAccountPurgeResponse{ApiResponse: ApiResponse{Type: JSApiAccountPurgeResponseType}}\n\n\t// Check for path like separators in the name.\n\tif strings.ContainsAny(accName, `\\/`) {\n\t\tresp.Error = NewJSStreamGeneralError(errors.New(\"account name can not contain path separators\"))\n\t\ts.sendAPIErrResponse(ci, acc, subject, reply, string(msg), s.jsonResponse(&resp))\n\t\treturn\n\t}\n\n\tif !s.JetStreamIsClustered() {\n\t\tvar streams []*stream\n\t\tvar ac *Account\n\t\tif ac, err = s.lookupAccount(accName); err == nil && ac != nil {\n\t\t\tstreams = ac.streams()\n\t\t}\n\n\t\ts.Noticef(\"Purge request for account %s (streams: %d, hasAccount: %t)\",\n\t\t\taccName, len(streams), ac != nil)\n\n\t\tfor _, mset := range streams {\n\t\t\terr := mset.delete()\n\t\t\tif err != nil {\n\t\t\t\tresp.Error = NewJSStreamDeleteError(err)","sourceCodeStart":3133,"sourceCodeEnd":3169,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jetstream_api.go#L3133-L3169","documentation":"A generic JetStream API validation error (JS_ERR_GENERIC) returned by the account purge/delete handler when the account name embedded in the API subject contains path separators ('/' or '\\\\'). Because account names map to storage directory names, path separators could enable path traversal, so the request is rejected before any purge happens.","triggerScenarios":"Sending $JS.API.ACCOUNT.PURGE (or similar account-scoped request) where token 5 of the subject (the account name) contains '/' or '\\\\', detected via strings.ContainsAny(accName, `\\\\/`).","commonSituations":"Passing a full account path or mis-split subject token as the account name; building API subjects by string concatenation with unsanitized account identifiers; automation that includes slashes in tenant/account names.","solutions":["Strip or reject path separators from the account name before building the API subject.","Use the account's canonical name (no slashes) when constructing $JS.API subjects.","Sanitize identifiers at the config layer so account names can never contain '/' or '\\\\'.","If a slash-bearing name is required, use an encoding scheme and decode on your side, not in the subject token."],"exampleFix":"// before\nsubj := fmt.Sprintf(\"$JS.API.%s\", accName) // accName = \"acme/prod\"\n// after\nif strings.ContainsAny(accName, `\\/`) {\n    return fmt.Errorf(\"invalid account name %q: path separators not allowed\", accName)\n}\nsubj := fmt.Sprintf(\"$JS.API.%s\", accName)","handlingStrategy":"validation","validationCode":"func validAccountName(name string) bool {\n    return name != \"\" && !strings.ContainsAny(name, `\\/`)\n}\nif !validAccountName(accName) { return fmt.Errorf(\"invalid account name %q\", accName) }\n","typeGuard":null,"tryCatchPattern":"if err := purgeAccount(nc, accName); err != nil {\n    if strings.Contains(err.Error(), \"path separators\") {\n        return fmt.Errorf(\"account name %q contains path separators\", accName)\n    }\n    return err\n}","preventionTips":["Sanitize account names at creation: reject '/' and '\\\\'","Never concatenate unsanitized identifiers into $JS.API subjects","Validate identifiers in config/CI before deployment","Use canonical account names, not paths, in API calls"],"tags":["jetstream","validation","path-traversal","nats-server"],"backgroundTag":"path-separator-in-name","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}