{"record":{"id":"8cff9cb468eb2499","repo":"alibaba/nacos","slug":"parameter-validate-error-8cff9c","errorCode":"PARAMETER_VALIDATE_ERROR","errorMessage":"filePath is invalid","messagePattern":"filePath is invalid","errorType":"validation","errorClass":"NacosApiException","httpStatus":400,"severity":"error","filePath":"ai-registry-adaptor/src/main/java/com/alibaba/nacos/airegistry/form/SkillsFileQueryForm.java","lineNumber":55,"sourceCode":"    @Override\n    public void validate() throws NacosApiException {\n        if (StringUtils.isBlank(namespaceId)) {\n            throw new NacosApiException(NacosApiException.INVALID_PARAM,\n                ErrorCode.PARAMETER_MISSING,\n                \"namespaceId is required\");\n        }\n        if (StringUtils.isBlank(skillName)) {\n            throw new NacosApiException(NacosApiException.INVALID_PARAM,\n                ErrorCode.PARAMETER_MISSING,\n                \"skillName is required\");\n        }\n        if (StringUtils.isBlank(filePath)) {\n            throw new NacosApiException(NacosApiException.INVALID_PARAM,\n                ErrorCode.PARAMETER_MISSING,\n                \"filePath is required\");\n        }\n        if (filePath.startsWith(\"/\") || filePath.startsWith(\"\\\\\") || filePath.contains(\"..\")) {\n            throw new NacosApiException(NacosApiException.INVALID_PARAM,\n                ErrorCode.PARAMETER_VALIDATE_ERROR,\n                \"filePath is invalid\");\n        }\n    }\n    \n    public String getNamespaceId() {\n        return namespaceId;\n    }\n    \n    public void setNamespaceId(String namespaceId) {\n        this.namespaceId = namespaceId;\n    }\n    \n    public String getSkillName() {\n        return skillName;\n    }\n    \n    public void setSkillName(String skillName) {","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/ai-registry-adaptor/src/main/java/com/alibaba/nacos/airegistry/form/SkillsFileQueryForm.java#L37-L73","documentation":"SkillsFileQueryForm guards against path traversal: filePath is rejected if it starts with '/' or '\\', or contains '..'. A match throws PARAMETER_VALIDATE_ERROR (HTTP 400). Note the '..' check is a substring test, so even legitimate names containing two consecutive dots are rejected.","triggerScenarios":"Calling the skill-file endpoint with ?filePath=/etc/passwd, ?filePath=../secret, ?filePath=..\\config, or any value starting with a slash/backslash or containing '..'.","commonSituations":"Supplying an absolute path; using relative traversal to escape the skill package; a filename that legitimately contains '..' (e.g. 'my..file.txt') which is also caught by the substring rule.","solutions":["Pass a relative path that does not start with '/' or '\\' and contains no '..', e.g. README.md or docs/guide.md.","Strip leading slashes from client-provided paths before sending.","If a real filename contains '..', rename it so the substring check passes."],"exampleFix":"// before\nGET /skill-file?...&filePath=../config/settings.yml\n\n// after\nGET /skill-file?...&filePath=config/settings.yml","handlingStrategy":"validation","validationCode":"// Reject unsafe paths before the call\nString p = filePath == null ? \"\" : filePath.trim();\nif (p.isEmpty() || p.startsWith(\"/\") || p.startsWith(\"\\\\\") || p.contains(\"..\")) {\n    throw new IllegalArgumentException(\"filePath is invalid: \" + filePath);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only send relative paths within the skill package.","Strip leading slashes from user-provided paths.","Avoid filenames containing '..'; rename if needed."],"tags":["skill","validation","security","path-traversal","ai"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}