{"record":{"id":"9a8ba7a1200d30de","repo":"payloadcms/payload","slug":"invalid-path-segment-only-alphanumeric-characters","errorCode":null,"errorMessage":"Invalid path segment. Only alphanumeric characters and underscores are permitted.","messagePattern":"Invalid path segment\\. Only alphanumeric characters and underscores are permitted\\.","errorType":"http","errorClass":"APIError","httpStatus":400,"severity":"error","filePath":"packages/drizzle/src/utilities/sanitizePathSegment.ts","lineNumber":12,"sourceCode":"import { APIError } from 'payload'\n\n/**\n * Validates that a path segment contains only allowed characters (word characters: [a-zA-Z0-9_]).\n *\n * @throws {APIError} if the segment contains characters outside /^[\\w]+$/\n */\nconst SAFE_PATH_SEGMENT_REGEX = /^\\w+$/\n\nexport const sanitizePathSegment = (segment: string): string => {\n  if (!SAFE_PATH_SEGMENT_REGEX.test(segment)) {\n    throw new APIError(\n      'Invalid path segment. Only alphanumeric characters and underscores are permitted.',\n      400,\n    )\n  }\n  return segment\n}\n","sourceCodeStart":1,"sourceCodeEnd":19,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/drizzle/src/utilities/sanitizePathSegment.ts#L1-L19","documentation":"Thrown by sanitizePathSegment when a path segment fails the regex /^\\w+$/ (only letters, digits, underscore). This guards dynamically-built query paths (e.g. JSON-path or column-path construction) against path-traversal/injection, since a segment is interpolated into a SQL/JSON path.","triggerScenarios":"Passing a path segment derived from user input (URL param, query param) that contains a dot, slash, space, quote, or any non-word character into a query path that goes through sanitizePathSegment.","commonSituations":"Reflecting req.query fields directly into a where-clause path; using a slug containing hyphens as a path segment.","solutions":["Whitelist-validate the segment against /^\\w+$/ before passing it into the query builder.","Map user-facing identifiers (slugs with hyphens) to internal word-only keys before use.","Reject or encode any segment containing dots, slashes, spaces, or punctuation."],"exampleFix":"// before\nconst seg = req.query.field // 'user.email' -> fails\nwhere: { [seg]: { equals: val } }\n// after\nconst seg = req.query.field\nif (!/^\\w+$/.test(seg)) throw new APIError('invalid field', 400)\nwhere: { [seg]: { equals: val } }","handlingStrategy":"validation","validationCode":"const SEG = /^\\w+$/\nfunction assertSafeSegment(s) {\n  if (!SEG.test(s)) throw new Error('Path segment contains invalid characters')\n}","typeGuard":"const isSafeSegment = (s) => /^\\w+$/.test(s)","tryCatchPattern":null,"preventionTips":["Never reflect user input into a query path without a whitelist.","Map hyphenated slugs to internal word-only keys before use in paths."],"tags":["query","security","injection","path","validation"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}