{"record":{"id":"60e5ca38c276d63a","repo":"langflow-ai/langflow","slug":"invalid-path","errorCode":null,"errorMessage":"Invalid path","messagePattern":"Invalid path","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"src/backend/base/langflow/agentic/api/files_router.py","lineNumber":115,"sourceCode":"    *,\n    current_user: CurrentActiveUser,\n    path: Annotated[str, Query(min_length=1, max_length=_MAX_PATH_LENGTH)],\n    download: Annotated[bool, Query()] = False,\n) -> Response:\n    \"\"\"Return the contents of a sandboxed file as text (or as an attachment).\n\n    Raises:\n        HTTPException(400): The path shape is invalid (traversal, absolute,\n            null byte, etc.). No I/O is attempted.\n        HTTPException(404): The file does not exist in the requesting user's\n            sandbox. Same status for sandbox-internal \"not found\" and for\n            \"path resolves outside the user namespace\" — by design, to avoid\n            leaking namespace existence to another tenant.\n        HTTPException(413): The file is larger than ``MAX_FILE_SIZE_BYTES``.\n        HTTPException(415): The file is binary (null byte in the first 8 KiB).\n    \"\"\"\n    if _is_unsafe_path_shape(path):\n        raise HTTPException(status_code=400, detail=\"Invalid path\")\n\n    # Deferred import: FileSystemToolComponent pulls a chunk of lfx — we don't\n    # want every router-import path to do it eagerly. We use the **same**\n    # security primitives the agent's tools use, not a parallel implementation.\n    from lfx.components.files_and_knowledge.filesystem import (\n        BINARY_SNIFF_BYTES,\n        MAX_FILE_SIZE_BYTES,\n        FileSystemToolComponent,\n        _looks_binary,\n        _read_bytes_no_follow,\n        _read_head_no_follow,\n    )\n\n    fs = FileSystemToolComponent()\n    fs._user_id = str(current_user.id)  # noqa: SLF001 — bind sandbox to caller\n    # B1: this endpoint carries an authenticated user identity and must\n    # always resolve a per-user sandbox root, even under AUTO_LOGIN=True\n    # (otherwise two users on a shared deployment read the same `shared/`","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/agentic/api/files_router.py#L97-L133","documentation":"The agentic file-read router validates the requested path shape before any I/O: traversal ('..'), absolute paths, null bytes, and similar malformed shapes raise HTTP 400 'Invalid path'. This is _is_unsafe_path_shape rejecting the string itself, independent of whether the file exists. It uses the same security primitives as the agent's FileSystemToolComponent rather than a parallel implementation.","triggerScenarios":"GET /api/v1/agentic/files?path=../../etc/passwd, path=/etc/hosts (absolute), or a path containing a null byte.","commonSituations":"LLM-generated tool output containing absolute or traversal paths fed straight into the API; clients joining user input with an OS path separator producing a leading slash; probing/pen-test payloads.","solutions":["Send a relative path under the user's sandbox, e.g. 'notes/todo.md' with no leading '/' and no '..' segments.","Normalize client-side: strip absolute prefixes and reject '..' before calling the API.","Treat 400 as a client bug — fix the path producer (often the model/tool prompt) rather than retrying."],"exampleFix":"# before\nGET /api/v1/agentic/files?path=/home/user/sandbox/notes.md  # 400 Invalid path\n# after\nGET /api/v1/agentic/files?path=notes.md","handlingStrategy":"validation","validationCode":"from pathlib import PurePosixPath\n\ndef safe_sandbox_path(p: str) -> bool:\n    if not p or \"\\x00\" in p:\n        return False\n    pp = PurePosixPath(p)\n    return not pp.is_absolute() and not any(part in (\"..\", \"\") for part in pp.parts) and \"\\\\\" not in p","typeGuard":null,"tryCatchPattern":"if resp.status_code == 400 and resp.json().get(\"detail\") == \"Invalid path\":\n    log_and_sanitize_the_path_producer()  # fix the generator (often LLM output), don't retry","preventionTips":["Always send relative POSIX paths with no '..' segments.","Sanitize LLM/tool output before it becomes a path parameter.","Treat 400 Invalid path as a client-side defect, never a server issue."],"tags":["agentic","files","http-400","path-traversal","validation"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}