{"record":{"id":"6e8906f362ea8db3","repo":"eclipse-vertx/vert.x","slug":"file-is-outside-of-the-cachedir-dir","errorCode":null,"errorMessage":"File is outside of the cacheDir dir: ","messagePattern":"File is outside of the cacheDir dir: ","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/file/impl/FileCache.java","lineNumber":245,"sourceCode":"    if (!overwrite) {\n      try {\n        Files.copy(is, cacheFile.toPath());\n      } catch (FileAlreadyExistsException ignore) {\n      }\n    } else {\n      Files.copy(is, cacheFile.toPath(), StandardCopyOption.REPLACE_EXISTING);\n    }\n  }\n\n  void cacheDir(String fileName) throws IOException {\n    File file = new File(getCacheDir(), fileName);\n    fileNameCheck(file);\n    file.mkdirs();\n  }\n\n  private void fileNameCheck(File file) throws IOException {\n    if (!file.getCanonicalFile().toPath().startsWith(getCacheDir().toPath())) {\n      throw new VertxException(\"File is outside of the cacheDir dir: \" + file);\n    }\n  }\n\n  private File getCacheDir() {\n    File currentCacheDir = cacheDir;\n    if (currentCacheDir == null) {\n      throw new IllegalStateException(\"cacheDir has been removed. FileResolver is closing?\");\n    }\n    return currentCacheDir;\n  }\n}\n","sourceCodeStart":227,"sourceCodeEnd":257,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/file/impl/FileCache.java#L227-L257","documentation":"Security guard in FileCache.fileNameCheck: the canonical path of the target cache file does not start with the cache directory path, i.e. the file name escapes the cache dir (path traversal). Caching or reading such a file is refused to prevent writes outside the cache; the offending file is appended to the message.","triggerScenarios":"Thrown at vertx-core/src/main/java/io/vertx/core/file/impl/FileCache.java:245 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject or sanitize file names containing '..' or absolute-path components before calling cacheFile/cacheDir","Validate resource names from untrusted sources"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}