{"record":{"id":"8c7485618d813db7","repo":"phacility/phabricator","slug":"string-s-is-invalid-in-path-specification-s","errorCode":null,"errorMessage":"String \"%s\" is invalid in path specification \"%s\".","messagePattern":"String \"(.+?)\" is invalid in path specification \"(.+?)\"\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/diffusion/ssh/DiffusionSubversionServeSSHWorkflow.php","lineNumber":379,"sourceCode":"  }\n\n  private function getPathFromSubversionURI($uri_string) {\n    $uri = new PhutilURI($uri_string);\n\n    $proto = $uri->getProtocol();\n    if ($proto !== 'svn+ssh') {\n      throw new Exception(\n        pht(\n          'Protocol for URI \"%s\" MUST be \"%s\".',\n          $uri_string,\n          'svn+ssh'));\n    }\n    $path = $uri->getPath();\n\n    // Subversion presumably deals with this, but make sure there's nothing\n    // sketchy going on with the URI.\n    if (preg_match('(/\\\\.\\\\./)', $path)) {\n      throw new Exception(\n        pht(\n          'String \"%s\" is invalid in path specification \"%s\".',\n          '/../',\n          $uri_string));\n    }\n\n    $path = $this->normalizeSVNPath($path);\n\n    return $path;\n  }\n\n  private function makeInternalURI($uri_string) {\n    if ($this->isProxying) {\n      return $uri_string;\n    }\n\n    $uri = new PhutilURI($uri_string);\n","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/diffusion/ssh/DiffusionSubversionServeSSHWorkflow.php#L361-L397","documentation":"Before normalizing the repository path, the workflow rejects any URI path containing '/../'. This is a path-traversal guard: SVN itself may cope with dot-dot segments, but Phabricator refuses them so a client cannot address anything outside the repository namespace while the URL path is mapped to a repository.","triggerScenarios":"A URL like svn+ssh://host/../../elsewhere crafted manually; client or tunnel rewriting that inserts relative segments; fuzzed input sent at the SSH endpoint.","commonSituations":"Security scanners probing the SSH service; scripts building checkout URLs by naive concatenation; users trying to reach a sibling repository with '..' segments.","solutions":["Clean the URL: reference the repository by its canonical path/callsign with no '..' segments","Fix scripts that assemble checkout paths via relative joins","Treat unexpected occurrences as probing of the instance and review access logs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (preg_match('(/\\\\.\\\\./)', $path)) {\n  throw new Exception('Reject ../ segments before mapping to a repository.');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Canonicalize user-supplied VCS paths before they reach server workflows","Never build checkout URLs by joining untrusted relative segments"],"tags":["phabricator","svn","path-traversal","security","uri-validation"],"backgroundTag":"path-traversal-blocked","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}