{"record":{"id":"d59ab50d2260acb4","repo":"abhigyanpatwari/GitNexus","slug":"refusing-unsafe-auto-sync-clone-root-under-dange","errorCode":null,"errorMessage":"Refusing unsafe auto-sync clone root under ${dangerousRoot}: ${root}","messagePattern":"Refusing unsafe auto-sync clone root under (.+?): (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"gitnexus/src/core/auto-sync/path-security.ts","lineNumber":217,"sourceCode":"        // The timestamp is the leading fixed-width field, so a descending\n        // string sort is newest-first.\n        .sort((a, b) => (a < b ? 1 : a > b ? -1 : 0))\n        .slice(QUARANTINE_MAX_ENTRIES_PER_REPO)\n        .map(async (entry) => {\n          await fs.rm(path.join(quarantineRoot, entry), { recursive: true, force: true });\n          await fs.rm(path.join(quarantineRoot, `${entry}.README.txt`), { force: true });\n        }),\n    ),\n  );\n}\n\nfunction assertNotDangerousRoot(root: string): void {\n  if (root === path.resolve(getGlobalDir(), 'repos')) return;\n  if (DANGEROUS_ROOTS.has(root)) throw new Error(`Refusing unsafe auto-sync clone root: ${root}`);\n  for (const dangerousRoot of DANGEROUS_PARENT_ROOTS) {\n    const rel = path.relative(dangerousRoot, root);\n    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) {\n      throw new Error(`Refusing unsafe auto-sync clone root under ${dangerousRoot}: ${root}`);\n    }\n  }\n  if (path.parse(root).root === root)\n    throw new Error(`Refusing filesystem root as clone root: ${root}`);\n}\n\nfunction assertNotGitNexusInternalRoot(root: string): void {\n  const gitnexusDir = path.resolve(getGlobalDir());\n  const blocked = [\n    path.join(gitnexusDir, 'groups'),\n    path.join(gitnexusDir, 'indexes'),\n    path.join(gitnexusDir, 'quarantine'),\n    path.join(getAutoSyncWatchDir(gitnexusDir), 'quarantine'),\n  ];\n  for (const blockedRoot of blocked) {\n    const rel = path.relative(blockedRoot, root);\n    if (!rel || (!rel.startsWith('..') && !path.isAbsolute(rel))) {\n      throw new Error(`Refusing GitNexus internal directory as auto-sync clone root: ${root}`);","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/0d1aed942f0e8b5d3bac27519fff441aceea722d/gitnexus/src/core/auto-sync/path-security.ts#L199-L235","documentation":"Thrown by assertNotDangerousRoot (via resolveConfiguredCloneRoot) when the resolved clone root is not itself blocklisted but path.relative() shows it is nested inside a DANGEROUS_PARENT_ROOT — a parent directory whose contents must not be mixed with cloned repositories (system directories, other tools' managed roots). The guard rejects any root that would be contained by, rather than equal to, a dangerous directory.","triggerScenarios":"Thrown at gitnexus/src/core/auto-sync/path-security.ts:217 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Move the clone root outside all DANGEROUS_PARENT_ROOTS — pick a sibling directory, not a child of a dangerous one","Use the default <globalDir>/repos location, which is explicitly whitelisted","Create a fresh top-level data directory (e.g. /var/lib/gitnexus or ~/gitnexus-repos) and configure that as the clone root"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0d1aed942f0e8b5d3bac27519fff441aceea722d","analyzedAt":"2026-09-08T00:40:44.970Z","contentChangedAt":"2026-09-08T00:40:44.970Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}