{"record":{"id":"90811d1908d52a90","repo":"MuntashirAkon/AppManager","slug":"could-not-create-directories-in-the-parent-directory","errorCode":null,"errorMessage":"Could not create directories in the parent directory.","messagePattern":"Could not create directories in the parent directory\\.","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/github/muntashirakon/io/PathImpl.java","lineNumber":402,"sourceCode":"        checkVfs(Paths.appendPathSegment(documentFile.getUri(), displayName));\n        DocumentFile file = documentFile.createDirectory(displayName);\n        if (file == null) throw new IOException(\"Could not create directory named \" + displayName);\n        return new PathImpl(context, file);\n    }\n\n    @NonNull\n    public Path createNewArbitraryFile(@NonNull String displayName, @Nullable String mimeType) throws IOException {\n        displayName = Paths.sanitize(displayName, true);\n        if (displayName == null) {\n            throw new IOException(\"Empty display name.\");\n        }\n        String[] names = displayName.split(File.separator);\n        if (names.length == 0) {\n            throw new IllegalArgumentException(\"Display name is empty.\");\n        }\n        for (String name : names) {\n            if (name.equals(\"..\")) {\n                throw new IOException(\"Could not create directories in the parent directory.\");\n            }\n        }\n        DocumentFile file = createArbitraryDirectories(documentFile, names, names.length - 1);\n        return createFileAsDirectChild(context, file, names[names.length - 1], mimeType);\n    }\n\n    @NonNull\n    public Path createDirectoriesIfRequired(@NonNull String displayName) throws IOException {\n        displayName = Paths.sanitize(displayName, true);\n        if (displayName == null) {\n            throw new IOException(\"Empty display name.\");\n        }\n        String[] dirNames = displayName.split(File.separator);\n        if (dirNames.length == 0) {\n            throw new IllegalArgumentException(\"Display name is empty\");\n        }\n        for (String name : dirNames) {\n            if (name.equals(\"..\")) {","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/io/PathImpl.java#L384-L420","documentation":"createNewArbitraryFile splits the display name on File.separator and creates any intermediate directories before the final file. Because SAF tree URIs cannot address above their tree root, a \"..\" segment would attempt to escape the parent; the library blocks this outright with this IOException.","triggerScenarios":"Passing a display name containing a \"..\" path segment (e.g. \"../escape.txt\", \"a/../../b.txt\") to createNewArbitraryFile.","commonSituations":"Building filenames from remote/relative paths that include parent-directory references; processing untrusted input that contains traversal sequences; converting Unix-style relative paths into SAF names.","solutions":["Normalize the input path and reject or strip any \"..\" segments before calling","Resolve the intended location yourself and pass only a name relative to the current Path","If the user genuinely needs a location outside this tree, create a Path for that tree instead"],"exampleFix":"// before\npath.createNewArbitraryFile(\"../escape.txt\", mime);\n// after\nif (Arrays.asList(name.split(\"/\")).contains(\"..\")) {\n    throw new IllegalArgumentException(\"Parent-directory segments not allowed\");\n}\npath.createNewArbitraryFile(name, mime);","handlingStrategy":"validation","validationCode":"for (String seg : displayName.split(\"/\")) { if (\"..\".equals(seg)) { throw new IllegalArgumentException(\".. not allowed\"); } }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat all display names as untrusted input and reject \"..\" segments explicitly","Keep user-supplied paths strictly relative to the current tree","Normalize paths before creating files, not inside the library call"],"tags":["android","security","path-traversal"],"backgroundTag":"path-traversal-blocked","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}