{"record":{"id":"792e4bcf6b1a4a81","repo":"Mintplex-Labs/anything-llm","slug":"invalid-path-792e4b","errorCode":null,"errorMessage":"Invalid path.","messagePattern":"Invalid path\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/utils/files/index.js","lineNumber":389,"sourceCode":" * @returns {boolean} True if `inner` is strictly inside `outer`, false otherwise.\n */\nfunction isWithin(outer, inner) {\n  const resolvedOuter = path.resolve(outer);\n  const resolvedInner = path.resolve(inner);\n  const rel = path.relative(resolvedOuter, resolvedInner);\n\n  if (rel === \"\") return false;\n  return (\n    !rel.startsWith(`..${path.sep}`) && rel !== \"..\" && !path.isAbsolute(rel)\n  );\n}\n\nfunction normalizePath(filepath = \"\") {\n  const result = path\n    .normalize(filepath.trim())\n    .replace(/^(\\.\\.(\\/|\\\\|$))+/, \"\")\n    .trim();\n  if ([\"..\", \".\", \"/\"].includes(result)) throw new Error(\"Invalid path.\");\n  return result;\n}\n\n/**\n * Strips characters that are illegal in Windows filenames, including Unicode\n * quotation marks (U+201C, U+201D, etc.) that can get corrupted into ASCII\n * double-quotes during charset conversion in the upload pipeline.\n * @param {string} fileName - The filename to sanitize.\n * @returns {string} - The sanitized filename.\n */\nfunction sanitizeFileName(fileName) {\n  if (!fileName) return fileName;\n  return fileName.replace(\n    /[<>:\"/\\\\|?*\\u201C\\u201D\\u201E\\u201F\\u2018\\u2019\\u201A\\u201B]/g,\n    \"\"\n  );\n}\n","sourceCodeStart":371,"sourceCodeEnd":407,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/utils/files/index.js#L371-L407","documentation":"Thrown by normalizePath() after it strips leading `../` segments and trims. It is a path-traversal / degenerate-path guard: if the cleaned result is exactly \"..\", \".\", or \"/\", the caller supplied an input that resolves to nothing safe, so the function refuses to return a usable path. Anything that flows user-controlled strings (folder names, filenames, doc locations) through normalizePath can surface this.","triggerScenarios":"Calling normalizePath with the literal strings \"..\", \".\", or \"/\"; with values that are only separators like \"//\" or \"\\\\\\\\\"; or with traversal payloads like \"../../../..\" whose leading-dotdir strip leaves nothing. Any /v1/document/upload/:folderName, logo rename, or doc-move path that hands a raw user string here.","commonSituations":"A frontend sending an empty-or-dots folder name on document upload; a migration script passing filesystem roots; a test fixture using \".\" as a placeholder; URL-encoded traversal (`%2e%2e`) decoded upstream before this call.","solutions":["Validate the input before calling normalizePath: reject empty, whitespace-only, and pure-dot/separator strings.","Treat the thrown Error as a 400 Bad Request at the endpoint boundary and surface a user-facing message rather than a stack trace.","If a default is acceptable for your caller, fall back to a generated safe name (e.g. uuid) instead of passing degenerate input.","Audit every call site that forwards req.params or req.body filenames into normalizePath to ensure they are single-segment names."],"exampleFix":"// before\nconst folder = normalizePath(folderName); // throws on \"..\", \".\", \"/\"\n\n// after\nif (!folderName || /^[./\\\\]+$/.test(folderName))\n  return response.status(400).json({ error: \"A real folder name is required.\" });\nconst folder = normalizePath(folderName);","handlingStrategy":"validation","validationCode":"function isSafePathSegment(name = '') {\n  const trimmed = String(name).trim();\n  if (!trimmed) return false;\n  if (['..', '.', '/'].includes(trimmed)) return false;\n  if (/^[./\\\\]+$/.test(trimmed)) return false;\n  if (trimmed.includes('/') || trimmed.includes('\\\\')) return false;\n  return true;\n}\n// call before normalizePath\nif (!isSafePathSegment(folderName)) return res.status(400).json({ error: 'Invalid path.' });","typeGuard":"function isNonDegeneratePathName(v): v is string {\n  return typeof v === 'string' && v.trim().length > 0 && !['..','.','/'].includes(v.trim()) && !/^[./\\\\]+$/.test(v);\n}","tryCatchPattern":"try {\n  const p = normalizePath(input);\n} catch (e) {\n  if (e.message === 'Invalid path.') return res.status(400).json({ error: e.message });\n  throw e;\n}","preventionTips":["Never pass raw req.params/req.body strings to normalizePath; sanitize first.","Maintain an allow-list charset regex for folder/file names at the controller.","Unit-test normalizePath with traversal, dot-only, and separator-only inputs."],"tags":["path-traversal","validation","security","filesystem"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}