{"record":{"id":"a182736306773ec9","repo":"cube-js/cube","slug":"modulepath-restricted","errorCode":null,"errorMessage":"'${modulePath}' restricted","messagePattern":"'(.+?)' restricted","errorType":"exception","errorClass":"UserError","httpStatus":null,"severity":"error","filePath":"packages/cubejs-schema-compiler/src/compiler/DataSchemaCompiler.ts","lineNumber":1003,"sourceCode":"    if (!currentFile.isModule && localImport) {\n      const fileName = localImport[1].match(/^.*\\.js$/) ? localImport[1] : `${localImport[1]}.js`;\n      const foundFile = toCompile.find((f) => f.fileName === fileName);\n      if (!foundFile) {\n        throw new UserError(`Required import for ${fileName} is not found`);\n      }\n      return foundFile;\n    }\n\n    const nodeModulesPath = path.resolve('node_modules');\n    let absPath = currentFile.isModule ?\n      path.resolve('node_modules', path.dirname(currentFile.fileName), modulePath) :\n      path.resolve('node_modules', modulePath);\n\n    if (!absPath.startsWith(nodeModulesPath)) {\n      if (this.allowNodeRequire) {\n        return null;\n      }\n      throw new UserError(`'${modulePath}' restricted`);\n    }\n    const packagePath = absPath.replace(nodeModulesPath, '').split('/').filter(s => !!s)[0];\n    if (!packagePath) {\n      if (this.allowNodeRequire) {\n        return null;\n      }\n      throw new UserError(`'${modulePath}' is incorrect`);\n    }\n    if (!this.isWhiteListedPackage(packagePath)) {\n      if (this.allowNodeRequire) {\n        return null;\n      }\n      throw new UserError(`Package '${packagePath}' not found`);\n    }\n    if (fs.existsSync(absPath)) {\n      const stat = fs.lstatSync(absPath);\n      if (stat.isDirectory()) {\n        absPath = path.resolve(absPath, 'index.js');","sourceCodeStart":985,"sourceCodeEnd":1021,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-schema-compiler/src/compiler/DataSchemaCompiler.ts#L985-L1021","documentation":"DataSchemaCompiler.resolveModuleFile resolves a module import from data model JS files to a path under node_modules. If the resolved absolute path escapes the project's node_modules directory (e.g. via '../' traversal or an absolute path), and allowNodeRequire is not enabled, the compiler refuses the import with UserError ''${modulePath}' restricted'. This is a sandbox/security guard so data models can only load whitelisted packages.","triggerScenarios":"Importing a module from a JS data model whose resolved path is not under node_modules: relative imports like '../shared/foo.js' that climb out of the schema folder, absolute paths, or imports that path.resolve normalizes outside node_modules while compile flags run without allowNodeRequire.","commonSituations":"Developers moving shared schema helpers outside the project, using path traversal in require/import statements, or running in environments (Cube Cloud / compiler API) where allowNodeRequire is disabled by default.","solutions":["Move the imported file into the project so it resolves under node_modules, or into the schema folder for relative imports","Enable allowNodeRequire in compiler options if arbitrary Node requires are acceptable in your environment","Inline or re-export the needed code through a whitelisted npm package installed in node_modules"],"exampleFix":"// before\nimport { formatDate } from '../shared/format';\n\n// after\nimport { formatDate } from './format'; // file placed inside the schema folder","handlingStrategy":"validation","validationCode":"const path = require('path');\nfunction isAllowedImport(modulePath) {\n  const abs = path.resolve('node_modules', modulePath);\n  return abs.startsWith(path.resolve('node_modules'));\n}\nif (!isAllowedImport('./../shared/foo')) throw new Error('import escapes node_modules');","typeGuard":null,"tryCatchPattern":"try {\n  await compiler.compile();\n} catch (e) {\n  if (String(e.message).endsWith(\"' restricted\")) {\n    console.error('Data model import outside node_modules:', e.message);\n  }\n}","preventionTips":["Keep schema helper files inside the schema folder and use './' relative imports","Never use '../' or absolute paths in data model imports","Distribute shared code as an npm package installed in node_modules"],"tags":["security","module-resolution","schema-compiler"],"backgroundTag":"module-import-restricted","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}