{"record":{"id":"8b77f6893ade57bb","repo":"FlowiseAI/Flowise","slug":"invalid-sqlite-path-encoded-path-traversal-attemp","errorCode":null,"errorMessage":"Invalid SQLite path: encoded path traversal attempt detected","messagePattern":"Invalid SQLite path: encoded path traversal attempt detected","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":340,"sourceCode":"    const defaultDir = allowedDirs[0]\n\n    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {\n        if (!userProvidedPath || userProvidedPath.trim() === '') {\n            return path.join(defaultDir, 'database.sqlite')\n        }\n        const bypassPath = userProvidedPath.trim()\n        return path.isAbsolute(bypassPath) ? bypassPath : path.resolve(path.join(defaultDir, bypassPath))\n    }\n\n    if (!userProvidedPath || userProvidedPath.trim() === '') {\n        throw new Error('Invalid SQLite path: database path is required')\n    }\n\n    const basePath = userProvidedPath.trim()\n\n    if (basePath.includes('..')) throw new Error('Invalid SQLite path: path traversal attempt detected')\n    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c'))\n        throw new Error('Invalid SQLite path: encoded path traversal attempt detected')\n    // eslint-disable-next-line no-control-regex\n    if (/\\0/.test(basePath) || /[\\x00-\\x1f]/.test(basePath))\n        throw new Error('Invalid SQLite path: null bytes or control characters detected')\n    if (/^[a-zA-Z]:\\\\/.test(basePath)) throw new Error('Invalid SQLite path: Windows absolute paths are not allowed')\n    if (/^\\\\\\\\[^\\\\]/.test(basePath)) throw new Error('Invalid SQLite path: UNC paths are not allowed')\n    if (/^\\\\\\\\\\?\\\\/.test(basePath)) throw new Error('Invalid SQLite path: extended-length paths are not allowed')\n\n    const resolvedPath = path.isAbsolute(basePath) ? path.resolve(basePath) : path.resolve(path.join(defaultDir, basePath))\n\n    if (resolvedPath.includes('..')) throw new Error('Invalid SQLite path: path traversal detected in resolved path')\n\n    if (!isPathWithinAllowedSQLiteDirs(resolvedPath, allowedDirs)) {\n        throw new Error(\n            `Invalid SQLite path: path must be within allowed directories (${allowedDirs.join(', ')}). Attempted path: ${resolvedPath}`\n        )\n    }\n\n    return resolvedPath","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L322-L358","documentation":"Thrown by validateSQLitePath (packages/components/src/validator.ts:340) when the SQLite path contains URL-encoded traversal sequences %2e, %2f, or %5c (case-insensitive). Encoded '..' is a classic bypass for substring filters; Flowise rejects it before resolution.","triggerScenarios":"A Database Path value like '%2e%2e/app.db' or '..%2Fsecret.db' reaches validateSQLitePath, often because request/chat input was forwarded without decoding.","commonSituations":"Binding raw URL parameters into node config; double-encoding bugs; copy-pasting URL-style paths from docs.","solutions":["decodeURIComponent() the input once, then pass a plain relative filename.","Use a simple filename with no percent sequences.","Sanitize upstream at the API boundary."],"exampleFix":"// before\nnodeParams.databasePath = req.query.db   // '%2e%2e/secret.db'\n\n// after\nnodeParams.databasePath = 'app.db'","handlingStrategy":"validation","validationCode":"const clean = (p) => decodeURIComponent(String(p ?? '')).replace(/[\\x00-\\x1f]/g, '');\nif (/%2e|%2f|%5c/i.test(String(databasePath ?? '')) || clean(databasePath).includes('..')) throw new Error('reject encoded traversal');","typeGuard":"const isDecodedSafe = (p: unknown): p is string => typeof p === 'string' && !/%2e|%2f|%5c/i.test(p) && !p.includes('..');","tryCatchPattern":"try { validateSQLitePath(databasePath) } catch (e) { if (e instanceof Error && /encoded path traversal/.test(e.message)) { databasePath = 'database.sqlite' } else throw e }","preventionTips":["Decode URL-encoded DB paths once before binding.","Reject %2e/%2f/%5c at the request boundary.","Forward only plain filenames to Sql Database nodes."],"tags":["path-traversal","security","validation","url-encoding","sqlite","database","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}