{"record":{"id":"7384508d1ce33a0a","repo":"googleapis/mcp-toolbox","slug":"path-q-must-be-absolute","errorCode":null,"errorMessage":"path %q must be absolute","messagePattern":"path %q must be absolute","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/tools/cloudstorage/cloudstoragecommon/paths.go","lineNumber":52,"sourceCode":"\tif p == \"\" {\n\t\treturn \"\", fmt.Errorf(\"path is empty\")\n\t}\n\t// Reject any \"..\" segment in the raw input. We check the raw input\n\t// (not just the cleaned output) so that escapes like\n\t// \"/legit/../../etc/passwd\" — which filepath.Clean collapses to an\n\t// innocuous-looking absolute path — are still rejected. Legitimate\n\t// names that happen to *contain* two dots (e.g. \"foo..bar\") are fine;\n\t// only a standalone \"..\" segment is disallowed.\n\tfor _, seg := range strings.FieldsFunc(p, func(r rune) bool {\n\t\treturn r == '/' || r == '\\\\'\n\t}) {\n\t\tif seg == \"..\" {\n\t\t\treturn \"\", fmt.Errorf(\"path %q contains '..'\", p)\n\t\t}\n\t}\n\tclean := filepath.Clean(p)\n\tif !filepath.IsAbs(clean) {\n\t\treturn \"\", fmt.Errorf(\"path %q must be absolute\", p)\n\t}\n\treturn clean, nil\n}\n\n// ResolveSymlinks returns the final filesystem target of path, following every\n// symbolic link along the way. Comparing *this* against a configured boundary —\n// rather than the caller-supplied name — is what stops a path that merely looks\n// like it sits inside the boundary from opening a file outside it.\n//\n// Paths whose trailing components do not exist yet (the normal case for a\n// download destination) are resolved as deeply as the filesystem allows, and\n// the missing components are appended literally.\n//\n// A component that exists as a symbolic link but does not resolve — a dangling\n// link — is rejected rather than treated as a missing name. Creating a file at\n// such a path follows the link, so accepting it on the strength of its literal\n// name would reopen the very escape this function exists to close.\n//","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/tools/cloudstorage/cloudstoragecommon/paths.go#L34-L70","documentation":"ValidateLocalPath requires absolute paths (after cleaning) for local file destinations; the given path is relative, so the tool refuses to guess where bytes would land.","triggerScenarios":"Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:52 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Prefix the path with a leading slash / full absolute path","Resolve relative paths against a configured base directory before calling the tool","Update the tool invocation to use absolute paths"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}