{"record":{"id":"b1c6c53533001059","repo":"overleaf/overleaf","slug":"invalid-dest-value","errorCode":null,"errorMessage":"invalid --dest value","messagePattern":"invalid --dest value","errorType":"exception","errorClass":"Errors.InvalidNameError","httpStatus":null,"severity":"error","filePath":"services/web/scripts/upload_file.mjs","lineNumber":128,"sourceCode":"    throw new Error(`local path is not a file: ${localPath}`)\n  }\n\n  const rawDestPath = opts.destPath ?? Path.basename(localPath)\n  let targetPath\n  try {\n    targetPath = normalizeTargetPath(rawDestPath)\n  } catch (error) {\n    const invalidValue =\n      opts.destPath !== undefined\n        ? `--dest=${JSON.stringify(opts.destPath)}`\n        : `derived basename ${rawDestPath} from FILE ${localPath}`\n    throw new Error(\n      `provide a non-empty destination project path; invalid value ${invalidValue}`\n    )\n  }\n\n  if (!SafePath.isCleanPath(targetPath)) {\n    throw new Errors.InvalidNameError('invalid --dest value')\n  }\n\n  const fileName = Path.posix.basename(targetPath)\n  if (!fileName || fileName === '.' || fileName === '..') {\n    throw new Error('destination path must include a file name')\n  }\n\n  return { ...opts, targetPath }\n}\n\nasync function confirmUpload(projectId, localPath, targetPath, assumeYes) {\n  if (assumeYes) {\n    return true\n  }\n\n  const rl = readline.createInterface({ input, output })\n  try {\n    const answer = await rl.question(","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/overleaf/overleaf/blob/28ad3b03b71cb4311decdcb55c36b33ec10d72db/services/web/scripts/upload_file.mjs#L110-L146","documentation":"After normalization, the target path must pass SafePath.isCleanPath(), Overleaf's guard against unsafe/invalid project paths (traversals, illegal characters, reserved names, relative segments). A plain Error with this message is thrown when the normalized destination fails that check, since such a path could never be a valid entity name in the project tree.","triggerScenarios":"--dest containing '..' segments, Windows drive letters or backslashes, illegal characters (e.g. *, ?, :, control chars), leading/trailing whitespace remnants, or names SafePath rejects (e.g. '.git'-style reserved names).","commonSituations":"Copying a Windows path (C:\\data\\plot.png) directly into --dest; including './' or '../' components; filenames with characters illegal in Overleaf projects produced by another tool.","solutions":["Rewrite --dest as a clean POSIX path: forward slashes only, no '..' or '.' segments, no illegal characters, e.g. /figures/plot.png.","Sanitize the filename programmatically (strip/replace invalid characters) before invoking the script.","Convert Windows paths: replace backslashes with '/' and drop the drive letter."],"exampleFix":"// before\nnode scripts/upload_file.mjs /tmp/plot.png --dest=\"C:\\figures\\plot.png\" ...\n// after\nnode scripts/upload_file.mjs /tmp/plot.png --dest=\"/figures/plot.png\" ...","handlingStrategy":"validation","validationCode":"const clean = (p) => p.replace(/\\\\/g, '/').split('/').filter(s => s && s !== '.' && s !== '..').join('/')\nconst dest = '/' + clean(rawDest)\n// then verify no illegal characters remain before invoking the script","typeGuard":"const isCleanPosixPath = (p) => typeof p === 'string' && !p.includes('\\\\') && !p.split('/').includes('..') && !/[\\u0000-\\u001f*?:\"<>|]/.test(p);","tryCatchPattern":"try {\n  await runUpload(opts)\n} catch (err) {\n  if (err.message === 'invalid --dest value') { console.error('Rewrite --dest as a clean POSIX path without .. or illegal characters'); process.exit(1) }\n  throw err\n}","preventionTips":["Normalize Windows paths (backslashes, drive letters) before passing --dest.","Sanitize tool-generated filenames against SafePath's illegal-character set.","Preview with --dry-run to catch path problems without side effects."],"tags":["cli","path-validation","safepath"],"backgroundTag":"invalid-path","analyzedSha":"28ad3b03b71cb4311decdcb55c36b33ec10d72db","analyzedAt":"2026-09-03T02:10:22.807Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T07:17:11.731Z"}