{"record":{"id":"50780d5942ec71bd","repo":"kestra-io/kestra","slug":"the-path-to-resolve-must-be-a-relative-path-inside","errorCode":null,"errorMessage":"The path to resolve must be a relative path inside the current working directory.","messagePattern":"The path to resolve must be a relative path inside the current working directory\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/LocalWorkingDir.java","lineNumber":92,"sourceCode":"    public synchronized Path path(boolean create) {\n        if (create && !this.workingDirPath.toFile().exists()) {\n            //noinspection ResultOfMethodCallIgnored\n            this.workingDirPath.toFile().mkdirs();\n        }\n        return this.workingDirPath;\n    }\n\n    /**\n     * {@inheritDoc}\n     **/\n    @Override\n    public Path resolve(Path path) {\n        if (path == null) {\n            return path();\n        }\n\n        if (path.toString().contains(\"..\" + File.separator)) {\n            throw new IllegalArgumentException(\"The path to resolve must be a relative path inside the current working directory.\");\n        }\n\n        Path baseDir = path();\n        Path resolved = baseDir.resolve(path).toAbsolutePath();\n\n        if (!resolved.startsWith(baseDir)) {\n            throw new IllegalArgumentException(\"The path to resolve must be a relative path inside the current working directory.\");\n        }\n\n        return resolved;\n    }\n\n    /**\n     * {@inheritDoc}\n     **/\n    @Override\n    public Path createTempFile() throws IOException {\n        return createTempFile(null, null);","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/LocalWorkingDir.java#L74-L110","documentation":"Thrown by `LocalWorkingDir.resolve(Path)` when the supplied path string contains the parent-directory sequence `..` followed by the platform file separator. This is the first of two path-traversal guards in `resolve`: it rejects any literal `..` segment before normalization. Thrown as `IllegalArgumentException`. The working directory is a sandbox; escaping it via `..` is forbidden.","triggerScenarios":"Calling `workingDir.resolve(Path.of(\"../escape.txt\"))` or any path containing `..` + separator — e.g. a filename derived from user input or a Pebble-rendered value that includes `..`. Common when a task constructs a filename from an untrusted source.","commonSituations":"A download/filename task whose name comes from an HTTP header or URL path containing `..`; test code using relative `..` paths; refactoring a path join that previously relied on a different base.","solutions":["Strip or reject `..` segments from untrusted filenames before resolving.","Use a plain relative filename with no parent reference.","If subdirectories are needed, use forward relative segments like `subdir/file.txt`."],"exampleFix":"// before\nPath p = workingDir.resolve(Path.of(\"../../etc/hosts\"));\n\n// after — sanitize and keep relative\nString name = raw.replaceAll(\"\\\\.\\\\.[\\\\/\\\\\\\\]\", \"\");\nPath p = workingDir.resolve(Path.of(name));","handlingStrategy":"validation","validationCode":"String raw = filename;\nif (raw != null && raw.contains(\"..\" + File.separator)) {\n    throw new IllegalArgumentException(\"Filename must not contain parent-directory references: \" + raw);\n}\nreturn workingDir.resolve(Path.of(raw));","typeGuard":"static boolean isSafeRelativePath(String name) {\n    return name != null && !name.isBlank()\n        && !name.contains(\"..\" + File.separator)\n        && !name.contains(\"../\") && !name.contains(\"..\\\\\");\n}","tryCatchPattern":null,"preventionTips":["Sanitize untrusted filenames: strip `..` segments and leading separators.","Use UUIDs or `IdUtils.create()` for generated filenames.","Prefer `workingDir.createTempFile()` for scratch files."],"tags":["working-dir","path-traversal","security","io"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}