{"record":{"id":"eb8e98e157c19b87","repo":"octobercms/october","slug":"editor-lang-filesystem-invalid-path","errorCode":null,"errorMessage":"editor::lang.filesystem.invalid_path","messagePattern":"editor::lang\\.filesystem\\.invalid_path","errorType":"validation","errorClass":"ApplicationException","httpStatus":null,"severity":"warning","filePath":"modules/editor/traits/FileSystemFunctions.php","lineNumber":31,"sourceCode":" * FileSystemFunctions implements common file and directory management functions for Tailor extensions.\n */\ntrait FileSystemFunctions\n{\n    /**\n     * editorCreateDirectory\n     */\n    protected function editorCreateDirectory($basePath, $newName, $parent)\n    {\n        if (!strlen($basePath)) {\n            throw new SystemException('The directory base path must not be empty');\n        }\n\n        if (!strlen($newName)) {\n            throw new ApplicationException(Lang::get('editor::lang.filesystem.directory_name_cant_be_empty'));\n        }\n\n        if (!$this->validateFileSystemPath($newName)) {\n            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_path'));\n        }\n\n        if (strlen($parent) && !$this->validateFileSystemPath($parent)) {\n            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_path'));\n        }\n\n        if (!$this->validateFileSystemName($newName)) {\n            throw new ApplicationException(Lang::get('editor::lang.filesystem.invalid_name'));\n        }\n\n        $newFullPath = $basePath.'/'.$parent.'/'.$newName;\n        if (file_exists($newFullPath) && is_dir($newFullPath)) {\n            throw new ApplicationException(Lang::get('editor::lang.filesystem.already_exists'));\n        }\n\n        if (!File::makeDirectory($newFullPath, 0755, true, true)) {\n            throw new ApplicationException(Lang::get(\n                'editor::lang.filesystem.error_creating_directory',","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/octobercms/october/blob/b608633a7e8922487d91a8161499020121c3b3bf/modules/editor/traits/FileSystemFunctions.php#L13-L49","documentation":"editorCreateDirectory runs validateFileSystemPath() on the new directory name. The validator accepts only characters matching /^[\\@0-9a-z.\\s_-\\/]+$/i and rejects any occurrence of '..' or './'. A failure raises editor::lang.filesystem.invalid_path; for the create-directory flow this guards against traversal and characters that are unsafe in theme paths.","triggerScenarios":"Submitting a directory name containing '..' (e.g. '../../modules') or './'; names with characters outside the allowed set such as '#', '(', ',', unicode letters, or a leading backslash; URL-encoded traversal payloads hitting the editor endpoint.","commonSituations":"Users pasting paths into the name field; scripts attempting path traversal through the editor API; names with accented or non-latin characters that the whitelist rejects.","solutions":["Use a plain name: letters, digits, dot, space, underscore, hyphen only (no slashes for a single directory name - see the invalid_name error for the name validator).","Remove any '..' or './' sequences from the submitted value.","ASCII-transliterate names containing accented or non-latin characters before submitting.","Keep the parent directory in the separate parent field rather than embedding slashes in the name."],"exampleFix":"// before\nnewName: '../partials'\n\n// after\nnewName: 'partials', parent: ''","handlingStrategy":"validation","validationCode":"/** Mirrors the editor's path whitelist: allowed chars, no '..' or './'. */\nfunction isValidEditorPath(string $path): bool\n{\n    if (!preg_match('/^[\\@0-9a-z\\.\\s_\\-\\/]+$/i', $path)) {\n        return false;\n    }\n    return strpos($path, '..') === false && strpos($path, './') === false;\n}\n\nif (!isValidEditorPath($newName)) {\n    throw new \\ValidationException(['name' => 'Invalid characters or traversal sequence']);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate names client-side with the same pattern before posting.","Never concatenate user input into paths server-side; pass segments separately.","ASCII-transliterate non-latin input in the editor UI."],"tags":["editor","filesystem","path-validation","security"],"backgroundTag":"invalid-path-validation","analyzedSha":"b608633a7e8922487d91a8161499020121c3b3bf","analyzedAt":"2026-08-21T04:24:57.515Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}