{"record":{"id":"9a8e4d0385215fde","repo":"quarkusio/quarkus","slug":"no-workspace-path-provided","errorCode":null,"errorMessage":"No workspace path provided","messagePattern":"No workspace path provided","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"extensions/devui/deployment/src/main/java/io/quarkus/devui/deployment/menu/WorkspaceProcessor.java","lineNumber":353,"sourceCode":"            return 9;\n        if (name.startsWith(\"src/integrationTest/\"))\n            return 10;\n\n        return 11;\n    }\n\n    private boolean isFileInRoot(String name) {\n        return !name.contains(\"/\");\n    }\n\n    /**\n     * Resolve a client supplied path URI and make sure it stays confined to the project root.\n     * The workspace operations are only meant to act on files inside the user's project, so any\n     * path (including ones using {@code ..} or symlinks) that resolves outside the root is rejected.\n     */\n    private static Path resolveWorkspacePath(Path rootPath, String uriString) {\n        if (uriString == null) {\n            throw new SecurityException(\"No workspace path provided\");\n        }\n\n        Path root;\n        Path resolved;\n        try {\n            root = toCanonicalPath(rootPath);\n            resolved = toCanonicalPath(Paths.get(URI.create(uriString)));\n        } catch (IllegalArgumentException | FileSystemNotFoundException | IOException e) {\n            // Malformed URI, a non-file scheme or a path we cannot safely canonicalize: reject it.\n            throw new SecurityException(\"Invalid workspace path: \" + uriString);\n        }\n\n        if (!resolved.startsWith(root)) {\n            throw new SecurityException(\"Path is outside the project root: \" + resolved);\n        }\n        return resolved;\n    }\n","sourceCodeStart":335,"sourceCodeEnd":371,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/devui/deployment/src/main/java/io/quarkus/devui/deployment/menu/WorkspaceProcessor.java#L335-L371","documentation":"Workspace operations in Dev UI (file creation/editing) resolve client-supplied path URIs against the project root with confinement checks. resolveWorkspacePath throws SecurityException when the supplied URI string is null — no path was provided at all. This guard exists because workspace actions must always target an explicit file inside the project.","triggerScenarios":"Invoking a Dev UI workspace action (createBuildTimeActions handlers, 'path' action) without passing the path URI parameter, so uriString == null when resolveWorkspacePath is called.","commonSituations":"Custom tooling or scripts calling the Dev UI workspace JSON-RPC actions without the path argument; a UI bug dropping the parameter; copy-pasted action invocations omitting required params.","solutions":["Always supply the file path URI (file: scheme, e.g. file:///home/user/project/src/main/java/App.java) in the request parameters.","Check parameter naming in the caller so the path value isn't read from the wrong key.","If writing custom tooling, validate the parameter is non-null before invoking the action.","Confirm you're calling the intended action that requires a path (some workspace actions differ)."],"exampleFix":"// before\nparams.put(\"path\", null); // or omitted\n\n// after\nparams.put(\"path\", \"file:///home/user/myproject/src/main/resources/application.properties\");","handlingStrategy":"validation","validationCode":"if (uriString == null || uriString.isBlank()) {\n    throw new IllegalArgumentException(\"A file: URI under the project root is required\");\n}","typeGuard":null,"tryCatchPattern":"try { Path p = resolveWorkspacePath(root, uri); ... }\ncatch (SecurityException e) {\n    if (e.getMessage().equals(\"No workspace path provided\")) {\n        ui.showError(\"Path parameter is missing\");\n    } else throw e;\n}","preventionTips":["Always include the path URI parameter in workspace action calls","Check parameter key names against the action's contract","Fail fast client-side on missing inputs"],"tags":["devui","workspace","security","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}