{"record":{"id":"6c9b445f1672cccd","repo":"apache/beam","slug":"error-validating-file-path-s-s-w","errorCode":null,"errorMessage":"error validating file path (%s, %s): %w","messagePattern":"error validating file path \\((.+?), (.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"sdks/go/pkg/beam/core/runtime/xlangx/expansionx/download.go","lineNumber":167,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"file path %q is outside destination directory %q\", filename, dest)\n\t}\n\treturn cleanPath, nil\n}\n\nfunc extractJar(source, dest string) error {\n\treader, err := zip.OpenReader(source)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error opening jar for extractJar(%s,%s): %w\", source, dest, err)\n\t}\n\n\tif err := os.MkdirAll(dest, 0700); err != nil {\n\t\treturn fmt.Errorf(\"error creating directory %s in extractJar(%s,%s): %w\", dest, source, dest, err)\n\t}\n\n\tfor _, file := range reader.File {\n\t\tfileName, err := validatePath(dest, file.Name)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error validating file path (%s, %s): %w\", dest, file.Name, err)\n\t\t}\n\t\tif file.FileInfo().IsDir() {\n\t\t\tos.MkdirAll(fileName, 0700)\n\t\t\tcontinue\n\t\t}\n\n\t\tsf, err := file.Open()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error opening source file %s: %w\", file.Name, err)\n\t\t}\n\t\tdefer sf.Close()\n\n\t\tdf, err := os.OpenFile(fileName, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0777)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error opening destination file %s: %w\", fileName, err)\n\t\t}\n\t\tdefer df.Close()\n","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/go/pkg/beam/core/runtime/xlangx/expansionx/download.go#L149-L185","documentation":"While iterating zip entries, extractJar calls validatePath(dest, file.Name) for every entry; this error wraps any path-validation failure with the destination and the offending entry name for context. It is the extractJar-level wrapper around the Zip Slip protection: an entry in the jar resolves outside the destination directory and cannot be safely extracted.","triggerScenarios":"An entry name in the jar contains ../ traversal segments, an absolute path, or otherwise fails filepath.Rel containment check during extractJar.","commonSituations":"A malicious or corrupted expansion-service jar; jars generated by tooling that wrote absolute entry paths; manually edited jars.","solutions":["Stop using this jar; it failed the safe-extraction check.","Identify the offending entry from the wrapped filename in the message.","Re-obtain the jar from the official artifact repository.","Rebuild the jar with relative entry paths if you control its creation."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Reject jars containing traversal entries before invoking extraction\nr, err := zip.OpenReader(jarPath)\nif err != nil { return err }\nfor _, f := range r.File {\n    if strings.Contains(f.Name, \"..\") || filepath.IsAbs(f.Name) {\n        return fmt.Errorf(\"jar contains unsafe entry %q\", f.Name)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := expansionx.MakeJar(ctx, url, dest)\nif err != nil && strings.Contains(err.Error(), \"error validating file path\") {\n    os.Remove(jarPath)\n    return fmt.Errorf(\"unsafe jar from %s rejected\", url)\n}","preventionTips":["Source jars only from trusted, checksum-verified repositories.","Scan archive entry names for traversal patterns before use.","Treat validation failures as supply-chain incidents, not retryable errors.","Keep jar provenance (URL + checksum) recorded per pipeline."],"tags":["go","security","zip-slip","path-traversal"],"backgroundTag":"path-traversal-blocked","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}