{"record":{"id":"651e07801c42f0e6","repo":"microsoft/playwright","slug":"har-entry-file-escapes-base-directory-file","errorCode":null,"errorMessage":"HAR entry _file escapes base directory: ${file}","messagePattern":"HAR entry _file escapes base directory: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/playwright-core/src/server/harBackend.ts","lineNumber":87,"sourceCode":"        status: response.status,\n        headers: response.headers,\n        body: buffer,\n      };\n    } catch (e) {\n      return { action: 'error', message: e.message };\n    }\n  }\n\n  private async _loadContent(content: { text?: string, encoding?: string, _file?: string }): Promise<Buffer> {\n    const file = content._file;\n    let buffer: Buffer;\n    if (file) {\n      if (this._zipFile) {\n        buffer = await this._zipFile.read(file);\n      } else {\n        const resolved = path.resolve(this._baseDir!, file);\n        if (!isPathInside(this._baseDir!, resolved))\n          throw new Error(`HAR entry _file escapes base directory: ${file}`);\n        buffer = await fs.promises.readFile(resolved);\n      }\n    } else {\n      buffer = Buffer.from(content.text || '', content.encoding === 'base64' ? 'base64' : 'utf-8');\n    }\n    return buffer;\n  }\n\n  private async _harFindResponse(url: string, method: string, headers: HeadersArray, postData: Buffer | undefined): Promise<har.Entry | undefined> {\n    const harLog = this._harFile.log;\n    const visited = new Set<har.Entry>();\n    while (true) {\n      const entries: har.Entry[] = [];\n      for (const candidate of harLog.entries) {\n        if (candidate.request.url !== url || candidate.request.method !== method)\n          continue;\n        if (method === 'POST' && postData && candidate.request.postData) {\n          const buffer = await this._loadContent(candidate.request.postData);","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/microsoft/playwright/blob/c8fc3bf8d31542d59b4d4d9eaab1df93ff541dc6/packages/playwright-core/src/server/harBackend.ts#L69-L105","documentation":"Thrown by HarBackend._loadContent() when a non-zipped HAR file's content entry has a _file property that, after path.resolve against the base directory, resolves to a path outside that base directory. This is a path-traversal security guard ensuring HAR content files cannot reference arbitrary filesystem locations.","triggerScenarios":"Replaying a HAR file via routeFromHAR() where the HAR's content._file field contains a relative path with directory traversal sequences (e.g., ../../etc/passwd). The check uses isPathInside() to verify the resolved path stays within the HAR's base directory. Only applies to non-zipped HAR files; zipped HARs read entries from the zip archive directly.","commonSituations":"HAR file was manually edited or generated by a tool that inserted unsafe relative paths. HAR file was moved to a different directory and the _file paths are now interpreted relative to a different base. Malicious or corrupted HAR file supplied by a third party. Incorrect HAR export tool that writes absolute or traversal-containing paths.","solutions":["Regenerate the HAR file using Playwright's built-in recording: npx playwright codegen --save-har=trace.har.","Inspect the HAR JSON and ensure all content._file values are simple relative filenames (no .. or absolute paths).","Use a zipped HAR format (.zip containing har.har) which bypasses the filesystem path check entirely.","Ensure the HAR file and its referenced content files reside in the same base directory."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate HAR content._file paths before replay\nconst har = JSON.parse(fs.readFileSync(harPath, 'utf-8'));\nfor (const entry of har.log.entries) {\n  if (entry.response?.content?._file?.includes('..'))\n    throw new Error(`HAR entry has unsafe _file path: ${entry.response.content._file}`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use Playwright's built-in HAR recording to ensure safe file paths.","Use zipped HAR format (.zip) which bypasses filesystem path checks.","Inspect HAR JSON for traversal sequences in content._file fields."],"tags":["har","path-traversal","security","harbackend","routefromhar"],"backgroundTag":null,"analyzedSha":"c8fc3bf8d31542d59b4d4d9eaab1df93ff541dc6","analyzedAt":"2026-08-12T07:26:36.950Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}