{"record":{"id":"aeedf7c30f666da2","repo":"remotion-dev/remotion","slug":"the-repository-contains-an-unsupported-path-pat","errorCode":null,"errorMessage":"The repository contains an unsupported path: ${path}","messagePattern":"The repository contains an unsupported path: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/browser-studio/src/load-github-repository.ts","lineNumber":115,"sourceCode":"\n\treturn response.statusText || `HTTP ${response.status}`;\n};\n\nconst encodePath = (path: string) =>\n\tpath\n\t\t.split('/')\n\t\t.map((segment) => encodeURIComponent(segment))\n\t\t.join('/');\n\nconst validateRepositoryPath = (path: string) => {\n\tif (\n\t\tpath.includes('\\\\') ||\n\t\tpath.includes('\\0') ||\n\t\tpath\n\t\t\t.split('/')\n\t\t\t.some((segment) => segment === '' || segment === '.' || segment === '..')\n\t) {\n\t\tthrow new Error(`The repository contains an unsupported path: ${path}`);\n\t}\n};\n\nconst decodeTextFile = (contents: Uint8Array) => {\n\tif (contents.includes(0)) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\treturn new TextDecoder('utf-8', {fatal: true}).decode(contents);\n\t} catch {\n\t\treturn null;\n\t}\n};\n\nexport const loadGitHubRepository = async ({\n\tonProgress,\n\trepoUrl,","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/remotion-dev/remotion/blob/10db9de07356446fb0edb3c3ae211369b693d18b/packages/browser-studio/src/load-github-repository.ts#L97-L133","documentation":"Before downloading anything, loadGitHubRepository runs every tree path through validateRepositoryPath(): no backslashes, no NUL bytes, and no empty, '.', or '..' path segments. This is a security guard against path traversal and escape when repository files are written into the virtual project and OPFS storage. A single offending filename blocks the entire repository from loading.","triggerScenarios":"Loading a GitHub repository whose tree contains any blob path with a backslash (e.g. 'src\\video.ts', usually created via the GitHub API by tooling), a NUL byte, or an empty/'.'/'..' segment. The check runs over every blob entry before the file-count and size checks.","commonSituations":"Third-party repositories you do not control, where CI or scripts committed filenames containing backslashes or control characters; almost never caused by the Browser Studio user's own actions.","solutions":["Rename the offending file in the repository (git mv 'src\\video.ts' src/video.ts) and push, then reload","Remove files with backslashes or control characters in their names from the repo","If you do not own the repo, it cannot be loaded in Browser Studio - clone it locally and fix the names first"],"exampleFix":"// before: repo tree contains a blob path 'src\\video.ts'\n// loadGitHubRepository({repoUrl}) -> Error: The repository contains an unsupported path: src\\video.ts\n\n// after: fix the filename in the repo\ngit mv 'src\\video.ts' src/video.ts\ngit commit -m 'fix path separator' && git push","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await loadGitHubRepository({repoUrl, signal});\n} catch (e) {\n  const msg = String((e as Error).message);\n  if (/unsupported path/.test(msg)) {\n    // extract the path from the message and tell the repo owner to rename it (git mv) and push\n  } else throw e;\n}","preventionTips":["Do not commit filenames containing backslashes or control characters - create paths with forward slashes","If you build tooling that commits files via the GitHub API, sanitize names to slash-separated ASCII paths","Test that your repo loads in Browser Studio before sharing the link"],"tags":["browser-studio","github","path-validation","security","path-traversal"],"backgroundTag":"path-traversal-blocked","analyzedSha":"10db9de07356446fb0edb3c3ae211369b693d18b","analyzedAt":"2026-08-22T21:45:17.748Z","contentChangedAt":"2026-08-22T21:45:17.748Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}