{"record":{"id":"e14dfac1326ab549","repo":"invoke-ai/InvokeAI","slug":"backslashes-not-allowed-in-subfolder-path","errorCode":null,"errorMessage":"Backslashes not allowed in subfolder path","messagePattern":"Backslashes not allowed in subfolder path","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"invokeai/app/services/image_files/image_files_disk.py","lineNumber":283,"sourceCode":"        else:\n            image_path = base_folder / basename\n\n        # Ensure the image path is within the base folder to prevent directory traversal\n        resolved_base = base_folder.resolve()\n        resolved_image_path = image_path.resolve()\n\n        if not resolved_image_path.is_relative_to(resolved_base):\n            raise ValueError(\"Image path outside outputs folder, potential directory traversal detected\")\n\n        return resolved_image_path\n\n    @staticmethod\n    def _validate_subfolder(subfolder: str) -> None:\n        \"\"\"Validates a subfolder path to prevent directory traversal while allowing controlled subdirectories.\"\"\"\n        if not subfolder:\n            return\n        if \"\\\\\" in subfolder:\n            raise ValueError(\"Backslashes not allowed in subfolder path\")\n        if subfolder.startswith(\"/\"):\n            raise ValueError(\"Absolute paths not allowed in subfolder path\")\n        parts = subfolder.split(\"/\")\n        for part in parts:\n            if part == \"..\":\n                raise ValueError(\"Parent directory references not allowed in subfolder path\")\n            if part == \"\":\n                raise ValueError(\"Empty path segments not allowed in subfolder path\")\n\n    def validate_path(self, path: Union[str, Path]) -> bool:\n        \"\"\"Validates the path given for an image or thumbnail.\"\"\"\n        path = path if isinstance(path, Path) else Path(path)\n        return path.exists()\n\n    def get_workflow(self, image_name: str, image_subfolder: str = \"\") -> str | None:\n        image = self.get(image_name, image_subfolder=image_subfolder)\n        workflow = image.info.get(\"invokeai_workflow\", None)\n        if isinstance(workflow, str):","sourceCodeStart":265,"sourceCodeEnd":301,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/services/image_files/image_files_disk.py#L265-L301","documentation":"_validate_subfolder rejects any subfolder containing a backslash, since backslashes are Windows path separators and could smuggle extra path components or traversal. It raises ValueError('Backslashes not allowed in subfolder path').","triggerScenarios":"Passing image_subfolder containing '\\\\' to get/save/get_path, e.g. 'sub\\\\dir' or a Windows-style relative path copied from a config.","commonSituations":"Windows users pasting paths into board/subfolder settings; code using os.path.join on Windows which emits backslashes; serialized paths shared between OSes.","solutions":["Normalize separators: replace '\\\\' with '/' before calling","Build the subfolder with posixpath.join or '/'.join(parts) instead of os.path.join","Strip drive letters and backslashes at the config/API boundary"],"exampleFix":"// before\nservice.save(data, name, image_subfolder='board\\\\2024')\n// after\nservice.save(data, name, image_subfolder='board/2024')","handlingStrategy":"validation","validationCode":"def normalize_subfolder(subfolder: str) -> str:\n    return subfolder.replace('\\\\', '/').strip('/')\nassert '\\\\' not in normalize_subfolder(sub)","typeGuard":"def has_no_backslashes(s: object) -> bool:\n    return isinstance(s, str) and '\\\\' not in s","tryCatchPattern":"try:\n    service.save(data, name, image_subfolder=subfolder)\nexcept ValueError as e:\n    if 'Backslashes' in str(e):\n        subfolder = subfolder.replace('\\\\', '/')\n        service.save(data, name, image_subfolder=subfolder)","preventionTips":["Always build subfolder paths with posixpath or '/', never os.path.join on Windows","Normalize user-supplied paths to POSIX form before storage calls","Test on Windows where backslashes are the native separator"],"tags":["validation","path","windows"],"backgroundTag":"invalid-path-separator","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}