{"record":{"id":"f083673d38d2859e","repo":"quarkusio/quarkus","slug":"cannot-be-used-in-resource-paths-but-got","errorCode":null,"errorMessage":"'..' cannot be used in resource paths, but got ","messagePattern":"'\\.\\.' cannot be used in resource paths, but got ","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"independent-projects/bootstrap/app-model/src/main/java/io/quarkus/paths/PathTreeVisit.java","lineNumber":44,"sourceCode":"    }\n\n    static boolean isAbsolutePath(String path) {\n        return path != null && !path.isEmpty()\n                && (path.charAt(0) == '/' // we want to check for '/' on every OS\n                        || USE_WINDOWS_ABSOLUTE_PATH_PATTERN\n                                && (windowsAbsolutePathPattern().matcher(path).matches())\n                        || path.startsWith(FileSystems.getDefault().getSeparator()));\n    }\n\n    static void ensureResourcePath(FileSystem fs, String path) {\n        if (isAbsolutePath(path)) {\n            throw new IllegalArgumentException(\"Expected a path relative to the root of the path tree but got \" + path);\n        }\n        // this is to disallow reading outside the path tree root\n        if (path != null && path.contains(\"..\")) {\n            for (Path pathElement : fs.getPath(path)) {\n                if (pathElement.toString().equals(\"..\")) {\n                    throw new IllegalArgumentException(\"'..' cannot be used in resource paths, but got \" + path);\n                }\n            }\n        }\n    }\n\n    static String resourceNameToFsPath(String resourceName, FileSystem fs) {\n        return fs.getSeparator().equals(\"/\") ? resourceName : resourceName.replace(\"/\", fs.getSeparator());\n    }\n\n    static void walk(Path root, Path rootDir, Path walkDir, PathFilter pathFilter, Map<String, String> multiReleaseMapping,\n            PathVisitor visitor) {\n        final PathTreeVisit visit = new PathTreeVisit(root, rootDir, pathFilter, multiReleaseMapping);\n        try (Stream<Path> files = Files.walk(walkDir)) {\n            final Iterator<Path> i = files.iterator();\n            while (i.hasNext()) {\n                if (!visit.setCurrent(i.next())) {\n                    continue;\n                }","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/bootstrap/app-model/src/main/java/io/quarkus/paths/PathTreeVisit.java#L26-L62","documentation":"PathTree resource lookup rejects resource paths containing '..' path segments. This is a security/integrity check in ensureResourcePath to disallow reading files outside the path tree root via path traversal. Any resource name that resolves to a literal '..' element is refused before the tree is walked.","triggerScenarios":"Calling a PathTree open/getResource/apply visitor API (e.g. via PathTreeUtils or CuratedApplication) with a resource name like 'foo/../../secret' or 'a/../b' where '..' survives as a path element after splitting.","commonSituations":"Resource names built by string concatenation from config properties or user input; normalized-relative paths that still contain '..' segments; classpath scanning code passing relative filesystem paths instead of resource names.","solutions":["Remove or normalize '..' segments from the resource path before passing it (e.g. Path.normalize() then verify it does not start with '/' and contains no '..')","Verify the resource name is a classpath-relative name like 'com/foo/Bar.class', not a filesystem path","If the intent is to reach an absolute/external file, do not go through the path tree; open the file directly"],"exampleFix":"// before\nString path = base + \"/../\" + resource;\ntree.apply(path, visitor);\n// after\nString path = Path.of(base, resource).normalize().toString();\nif (path.contains(\"..\")) { throw new IllegalArgumentException(\"bad path\"); }\ntree.apply(path, visitor);","handlingStrategy":"validation","validationCode":"if (resourcePath == null || resourcePath.startsWith(\"/\") || resourcePath.contains(\"..\")) { throw new IllegalArgumentException(\"Invalid resource path: \" + resourcePath); }","typeGuard":"boolean isValidResourcePath(String p) { return p != null && !p.startsWith(\"/\") && !p.contains(\"..\"); }","tryCatchPattern":"try { tree.apply(path, visitor); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"'..'\") || e.getMessage().startsWith(\"Expected a path relative\")) { log.warn(\"Rejected resource path: \" + path); } else { throw e; } }","preventionTips":["Always Path.normalize() derived paths and assert no '..' remains","Build resource names from package names, not filesystem paths","Never concatenate user/config input directly into resource paths"],"tags":["classpath","path-traversal","security","validation"],"backgroundTag":"path-traversal-rejected","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}