{"record":{"id":"8593bbd9bfa302d4","repo":"kestra-io/kestra","slug":"path-must-not-contain","errorCode":null,"errorMessage":"Path must not contain '../'","messagePattern":"Path must not contain '\\.\\./'","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/pebble/functions/FileURIFunction.java","lineNumber":57,"sourceCode":"        defaults.put(NAMESPACE, null);\n        defaults.put(REVISION, null);\n        return defaults;\n    }\n\n    @Override\n    protected Object fileFunction(EvaluationContext context, URI path, String namespace, String tenantId, Map<String, Object> args) throws IOException {\n        return switch (path.getScheme()) {\n            case StorageContext.KESTRA_SCHEME -> path.toString();\n            case LocalPath.FILE_SCHEME -> path.toString();\n            case Namespace.NAMESPACE_FILE_SCHEME -> getNamespaceFileURI(path, namespace, tenantId, args);\n            default -> throw new IllegalArgumentException(SCHEME_NOT_SUPPORTED_ERROR.formatted(path));\n        };\n    }\n\n    private String getNamespaceFileURI(URI path, String namespace, String tenantId, Map<String, Object> args) throws IOException {\n        String pathStr = path.getPath();\n        if (pathStr.contains(\"../\")) {\n            throw new IllegalArgumentException(\"Path must not contain '../'\");\n        }\n        Namespace namespaceStorage = namespaceFactory.get().of(tenantId, namespace, storageInterface.get());\n        Path filePath = NamespaceFile.normalize(Path.of(pathStr));\n\n        if (args.containsKey(REVISION)) {\n            Integer revision;\n            try {\n                revision = Integer.parseInt(args.get(REVISION).toString());\n            } catch (NumberFormatException e) {\n                throw new IllegalArgumentException(\"The 'fileURI' function expects the 'revision' argument to be a valid integer.\");\n            }\n            try {\n                namespaceStorage.getFileContent(filePath, revision).close();\n            } catch (FileNotFoundException e) {\n                throw new FileNotFoundException(\"Revision \" + revision + \" of file '\" + filePath + \"' was not found in namespace '\" + namespace + \"'.\");\n            }\n            NamespaceFile namespaceFile = NamespaceFile.of(namespace, filePath, revision);\n            return namespaceFile.uri().toString();","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/pebble/functions/FileURIFunction.java#L39-L75","documentation":"Thrown by 'fileURI' inside getNamespaceFileURI() when the URI path string contains '../'. This is an explicit path-traversal guard: namespace file access is restricted to within the namespace, so escaping via parent-directory segments is rejected before any storage operation.","triggerScenarios":"Calling fileURI() with a namespace file path that includes '../' to climb above the namespace root, e.g. namespace:///../secret or a path built from user input that injects '../'.","commonSituations":"Constructing a namespace file path dynamically from untrusted user input (flow inputs) without sanitizing; attempting to read a file outside the current namespace; copy-pasting a filesystem-relative path into a namespace URI.","solutions":["Remove any '../' from the path; reference files only within the target namespace.","If the path is built from user input, sanitize/normalize it (resolve and confirm it stays under the namespace root) before passing it to fileURI().","Move the needed file into the correct namespace instead of traversing out."],"exampleFix":"# before\nuri: \"{{ fileURI('namespace:///../shared/secret.yaml') }}\"\n# after - reference the file within the correct namespace\nuri: \"{{ fileURI('namespace:///shared/secret.yaml') }}\"","handlingStrategy":"validation","validationCode":"# Reject '../' in the path before calling fileURI().\n# {{ (not (path contains '../')) ? fileURI(path) : null }}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never include '../' in namespace file paths.","Sanitize paths built from user/flow input before passing to fileURI().","Reference files only within the target namespace.","Normalize and verify the path stays under the namespace root."],"tags":["pebble","file","fileuri","security","path-traversal","namespace","validation"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}