{"record":{"id":"6da20284c78577c6","repo":"FlowiseAI/Flowise","slug":"invalid-path-characters-detected","errorCode":null,"errorMessage":"Invalid path characters detected","messagePattern":"Invalid path characters detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/storage/BaseStorageProvider.ts","lineNumber":88,"sourceCode":"        return storagePath\n    }\n\n    /**\n     * Shared utility for validating chatflowId format (UUID)\n     */\n    protected validateChatflowId(chatflowId: string): void {\n        if (!chatflowId || !isValidUUID(chatflowId)) {\n            throw new Error('Invalid chatflowId format - must be a valid UUID')\n        }\n    }\n\n    /**\n     * Shared utility for checking path traversal attempts\n     */\n    protected validatePathSecurity(...paths: string[]): void {\n        for (const p of paths) {\n            if (p && isPathTraversal(p)) {\n                throw new Error('Invalid path characters detected')\n            }\n        }\n    }\n\n    /**\n     * Shared utility for building a storage path from components\n     */\n    protected buildPath(...paths: string[]): string {\n        const sanitizedPaths = paths.filter((p) => p && typeof p === 'string').map((p) => this.sanitizeFilename(p))\n        return path.join(this.storagePath, ...sanitizedPaths)\n    }\n}\n","sourceCodeStart":70,"sourceCodeEnd":101,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/storage/BaseStorageProvider.ts#L70-L101","documentation":"Thrown by BaseStorageProvider.validatePathSecurity when any of the supplied path components is flagged by isPathTraversal. It is a defense-in-depth check layered on top of per-component sanitization, catching traversal sequences in arbitrary path arguments (e.g. chatId).","triggerScenarios":"A storage call where one of the path arguments contains `..`, absolute-path indicators, NUL bytes, or other traversal patterns detected by isPathTraversal. The loop at BaseStorageProvider.ts:85-87 checks each path.","commonSituations":"User-controlled chatId or sub-path values that are not validated at the API boundary; crafted requests targeting storage endpoints.","solutions":["Validate every user-supplied path segment (chatId, sub-folders) against a strict allowlist pattern before calling storage.","Reject any segment containing `..`, separators, or non-printable characters at the route handler.","Prefer opaque identifiers (UUIDs) for path components instead of free-form strings."],"exampleFix":"// before\nawait provider.streamStorageFile(chatflowId, '../../../etc', fileName, orgId)\n// after\nif (!/^[-a-zA-Z0-9]+$/.test(chatId)) throw new Error('bad chatId')\nawait provider.streamStorageFile(chatflowId, chatId, fileName, orgId)","handlingStrategy":"validation","validationCode":"const SEGMENT_RE = /^[-a-zA-Z0-9_]+$/\nfunction validatePathSegments(...segments: string[]): void {\n  for (const s of segments) {\n    if (s && !SEGMENT_RE.test(s)) throw new Error('Invalid path characters detected')\n  }\n}","typeGuard":"function isSafePathSegment(s: unknown): s is string {\n  return typeof s === 'string' && /^[-a-zA-Z0-9_]+$/.test(s)\n}","tryCatchPattern":null,"preventionTips":["Restrict path segments to alphanumeric/underscore/dash at the API boundary.","Prefer UUIDs for chatId and similar components.","Reject any segment with separators or '..'."],"tags":["security","path-traversal","storage","validation"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}