{"record":{"id":"caf944b945564517","repo":"apple/pkl","slug":"resourcenotinallowlist-modulenotinallowlist","errorCode":"resourceNotInAllowList|moduleNotInAllowList","errorMessage":"resourceNotInAllowList|moduleNotInAllowList","messagePattern":"resourceNotInAllowList\\|moduleNotInAllowList","errorType":"error_code","errorClass":"SecurityManagerException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/SecurityManagers.java","lineNumber":219,"sourceCode":"        }\n        return path.toAbsolutePath();\n      } catch (IOException e) {\n        throw new UncheckedIOException(e);\n      }\n    }\n\n    private void checkRead(URI uri, List<Pattern> allowedPatterns, boolean isResource)\n        throws SecurityManagerException {\n      for (var pattern : allowedPatterns) {\n        if (pattern.matcher(uri.toString()).lookingAt()) {\n          checkIsUnderRootDir(uri, isResource);\n          return;\n        }\n      }\n\n      var messageKey = isResource ? \"resourceNotInAllowList\" : \"moduleNotInAllowList\";\n      var message = ErrorMessages.create(messageKey, uri);\n      throw new SecurityManagerException(message);\n    }\n\n    private void checkIsUnderRootDir(URI uri, boolean isResource) throws SecurityManagerException {\n      // handle jar:file: URIs correctly:\n      var checkUri =\n          uri.getScheme().equals(\"jar\") ? IoUtils.createUri(uri.getSchemeSpecificPart()) : uri;\n\n      if (!checkUri.isAbsolute()) {\n        throw new AssertionError(\"Expected absolute URI but got: \" + checkUri);\n      }\n\n      if (rootDir == null || !checkUri.getScheme().equals(\"file\")) return;\n\n      var path = Path.of(checkUri);\n\n      // uri represents a UNC path if authority is non-null\n      // so treat this like a potentially redirected HTTP read:\n      // check if both the given and real paths are under rootDir","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/SecurityManagers.java#L201-L237","documentation":"Pkl's security manager blocks module or resource imports whose URI is not explicitly listed in the allowedModules/allowedResources allow lists. checkRead throws SecurityManagerException with messageKey resourceNotInAllowList (for resources) or moduleNotInAllowList (for modules). This is the sandboxing mechanism that prevents pkl code from loading arbitrary external modules or resources.","triggerScenarios":"Calling checkResolveModule/checkResolveResource/checkReadResource (via SecurityManagers.checkRead) with a URI that matches no entry in the configured allowedModules or allowedResources lists.","commonSituations":"Running `pkl eval` with --allowed-modules/--allowed-resources that omit a dependency's module path; embedding pkl in an app whose SecurityManager allow list was built for one project and reused for another; a new import added to Pkl code without updating the security policy.","solutions":["Add the offending URI (or a glob pattern covering it) to allowedModules/allowedResources in the SecurityManagers.StandardBuilder.","When using the CLI, pass --allowed-modules and/or --allowed-resources with the module/resource path being loaded.","Inspect the full URI in the exception message and confirm scheme/authority spelling exactly matches an allow-list entry."],"exampleFix":"// before\nnew SecurityManagers.StandardBuilder()\n    .allowModule(\"example.com/base@1\")\n    .build();\n// after\nnew SecurityManagers.StandardBuilder()\n    .allowModule(\"example.com/base@1\")\n    .allowModule(\"example.com/geo@1\") // module actually imported\n    .build();","handlingStrategy":"validation","validationCode":"String uri = \"example.com/geo@1\";\nboolean allowed = allowedModules.stream().anyMatch(uri::startsWith);\nif (!allowed) throw new IllegalStateException(\"module not in allow list: \" + uri);","typeGuard":null,"tryCatchPattern":"try {\n  evaluator.evaluateOutputText(moduleUri);\n} catch (SecurityManagerException e) {\n  if (e.getMessage().contains(\"NotInAllowList\")) {\n    // reconfigure allowedModules/allowedResources and retry once\n  } else throw e;\n}","preventionTips":["Derive allowedModules/allowedResources automatically from the dependency graph rather than hand-maintaining.","Use glob patterns (e.g. example.com/**) to reduce omissions.","Test security policy with a smoke evaluation in CI."],"tags":["security","allowlist","module-loading","pkl"],"backgroundTag":"permission-denied","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}