{"record":{"id":"8f5a591c6b435d39","repo":"langflow-ai/langflow","slug":"invalid-label-use-a-simple-label-without-dire","errorCode":null,"errorMessage":"Invalid {label}. Use a simple {label} without directory paths or '..'.","messagePattern":"Invalid (.+?)\\. Use a simple (.+?) without directory paths or '\\.\\.'\\.","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"src/backend/base/langflow/api/utils/core.py","lineNumber":63,"sourceCode":"        \"set_cookie\",\n    }\n)\n\nMAX_PAGE_SIZE = 50\nMIN_PAGE_SIZE = 1\n\nCurrentActiveUser = Annotated[User, Depends(get_current_active_user)]\nCurrentActiveMCPUser = Annotated[User, Depends(get_current_active_user_mcp)]\n# DbSession with auto-commit for write operations\nDbSession = Annotated[AsyncSession, Depends(injectable_session_scope)]\n# DbSessionReadOnly for read-only operations (no auto-commit, reduces lock contention)\nDbSessionReadOnly = Annotated[AsyncSession, Depends(injectable_session_scope_readonly)]\n\n\ndef _get_validated_path_segment(value: str, *, label: str = \"name\") -> str:\n    \"\"\"Validate a path segment to prevent path traversal attacks.\"\"\"\n    if \"..\" in value or \"/\" in value or \"\\\\\" in value:\n        raise HTTPException(\n            status_code=400,\n            detail=f\"Invalid {label}. Use a simple {label} without directory paths or '..'.\",\n        )\n    return value\n\n\ndef _get_validated_file_name(file_name: str = Path()) -> str:\n    return _get_validated_path_segment(file_name, label=\"file name\")\n\n\ndef _get_validated_folder_name(folder_name: str = Path()) -> str:\n    return _get_validated_path_segment(folder_name, label=\"folder name\")\n\n\nValidatedFileName = Annotated[str, Depends(_get_validated_file_name)]\nValidatedFolderName = Annotated[str, Depends(_get_validated_folder_name)]\n\n# Message to raise if we're in an Astra cloud environment and a component or endpoint is not supported","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/utils/core.py#L45-L81","documentation":"HTTP 400 from _get_validated_path_segment (used for file and folder name query params) when the supplied value contains '..', '/', or '\\\\'. It is a path-traversal guard: names used for component/file/folder endpoints must be a single path segment with no separators or parent references.","triggerScenarios":"Calling endpoints whose file_name/folder_name FastAPI dependency uses _get_validated_file_name/_get_validated_folder_name with values like '../etc/passwd', 'sub/dir/file.py', or 'a\\\\b'.","commonSituations":"Clients passing full relative paths instead of bare names; imports/scripts generating names from user text containing slashes; security scanners probing traversal payloads.","solutions":["Send only the final path segment (basename) as file_name/folder_name","Strip slashes and '..' client-side before the call: name.split('/').pop()","If legitimate nested paths are needed, use an endpoint that accepts full paths by design, not these segment-validated params"],"exampleFix":"# before\nGET /api/v1/component/file?file_name=my_folder/my_component.py  # 400\n# after\nGET /api/v1/component/file?file_name=my_component.py","handlingStrategy":"validation","validationCode":"const safeSegment = (name) => {\n  if (/[\\\\/]/.test(name) || name.includes('..')) throw new Error('invalid segment');\n  return name.split('/').pop();\n};","typeGuard":"const isSafePathSegment = (s) => typeof s === 'string' && s.length > 0 && !s.includes('/') && !s.includes('\\\\') && !s.includes('..');","tryCatchPattern":null,"preventionTips":["Send basenames only to file_name/folder_name params","Sanitize user-derived names before query-string construction","Remember this 400 is a security guard, not a formatting nit"],"tags":["path-traversal","http-400","security","validation"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}