{"record":{"id":"f8d47e349e0d70ef","repo":"ViewComponent/view_component","slug":"viewcomponent-systemtest-controller-attempted-to-l","errorCode":null,"errorMessage":"ViewComponent SystemTest controller attempted to load a file outside of the expected directory.","messagePattern":"ViewComponent SystemTest controller attempted to load a file outside of the expected directory\\.","errorType":"http","errorClass":"ViewComponent::SystemTestControllerNefariousPathError","httpStatus":404,"severity":"error","filePath":"app/controllers/view_components_system_test_controller.rb","lineNumber":32,"sourceCode":"\n    def system_test_entrypoint\n      render file: @path\n    end\n\n    private\n\n    def render_not_found\n      head :not_found\n    end\n\n    # Ensure that the file path is valid and doesn't target files outside\n    # the expected directory (e.g. via a path traversal or symlink attack)\n    def validate_file_path\n      base_path = ::File.realpath(self.class.temp_dir)\n      @path = ::File.realpath(params.permit(:file)[:file], base_path)\n      allowed_prefix = \"#{base_path}#{::File::SEPARATOR}\"\n      unless @path == base_path || @path.start_with?(allowed_prefix)\n        raise ViewComponent::SystemTestControllerNefariousPathError\n      end\n    end\n  end\nend\n","sourceCodeStart":14,"sourceCodeEnd":37,"githubUrl":"https://github.com/ViewComponent/view_component/blob/9f22c36fa7d7b44098a8ed97472e3b4674ae420f/app/controllers/view_components_system_test_controller.rb#L14-L37","documentation":"Error \"ViewComponent SystemTest controller attempted to load a file outside of the expected directory.\" thrown in ViewComponent/view_component.","triggerScenarios":"Thrown at app/controllers/view_components_system_test_controller.rb:32 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Move the file being loaded so it lives inside one of the directories listed in config.view_component.preview_paths.","If the file legitimately lives elsewhere, add that directory to config.view_component.preview_paths so the controller's path validation accepts it.","Remove any path traversal (../) segments from the requested preview path."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9f22c36fa7d7b44098a8ed97472e3b4674ae420f","analyzedAt":"2026-08-23T10:20:47.008Z","schemaVersion":2},"datasetVersion":"2026-08-23T13:39:53.451Z"}