{"record":{"id":"8637d43db468571e","repo":"hyperledger/fabric","slug":"error-validating-chaincode-path-s","errorCode":null,"errorMessage":"error validating chaincode path: %s","messagePattern":"error validating chaincode path: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/platforms/node/platform.go","lineNumber":64,"sourceCode":"}\n\n// ValidatePath validates Go chaincodes\nfunc (p *Platform) ValidatePath(rawPath string) error {\n\tpath, err := url.Parse(rawPath)\n\tif err != nil || path == nil {\n\t\treturn fmt.Errorf(\"invalid path: %s\", err)\n\t}\n\n\t// Treat empty scheme as a local filesystem path\n\tif path.Scheme == \"\" {\n\t\tpathToCheck, err := filepath.Abs(rawPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error obtaining absolute path of the chaincode: %s\", err)\n\t\t}\n\n\t\texists, err := pathExists(pathToCheck)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error validating chaincode path: %s\", err)\n\t\t}\n\t\tif !exists {\n\t\t\treturn fmt.Errorf(\"path to chaincode does not exist: %s\", rawPath)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (p *Platform) ValidateCodePackage(code []byte) error {\n\t// FAB-2122: Scan the provided tarball to ensure it only contains source-code under\n\t// the src folder.\n\t//\n\t// It should be noted that we cannot catch every threat with these techniques.  Therefore,\n\t// the container itself needs to be the last line of defense and be configured to be\n\t// resilient in enforcing constraints. However, we should still do our best to keep as much\n\t// garbage out of the system as possible.\n\tre := regexp.MustCompile(`^(/)?(src|META-INF)/.*`)\n\tis := bytes.NewReader(code)","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/platforms/node/platform.go#L46-L82","documentation":"After resolving a scheme-less path to an absolute path, ValidatePath checks existence with pathExists. If that check itself returns an error (as opposed to reporting non-existence), this wrapper error is returned.","triggerScenarios":"pathExists fails while stat-ing the absolute chaincode path — typically a permission error on a parent directory or an I/O error during os.Stat.","commonSituations":"Parent directories without execute/read permission for the fabric peer user; the path traversing a filesystem that is unavailable (unmounted volume); SELinux/AppArmor denials.","solutions":["Fix filesystem permissions so the peer process can traverse every path component","Verify the volume containing the chaincode is mounted and accessible","Check audit logs / denials (SELinux, AppArmor) blocking stat on the path"],"exampleFix":"// before\n// peer runs as user 'fabric', /opt/chaincode is 0700 root:root\n// after\nchown -R fabric:fabric /opt/chaincode && chmod -R u+rx /opt/chaincode","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(rawPath); err != nil { return fmt.Errorf(\"cannot access path: %v\", err) }","typeGuard":null,"tryCatchPattern":"if err := platform.ValidatePath(rawPath); err != nil && strings.Contains(err.Error(), \"error validating chaincode path\") {\n    // fix permissions/mounts\n}","preventionTips":["Grant traverse permissions to the peer user","Verify mounts before install"],"tags":["chaincode","node","filesystem","permissions"],"backgroundTag":"path-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}