{"record":{"id":"fbf15ec009a7bb8d","repo":"paperclipai/paperclip","slug":"kubernetes-sync-label-path-escapes-the-workspac","errorCode":null,"errorMessage":"Kubernetes sync ${label} path escapes the workspace remote dir: ${candidate}","messagePattern":"Kubernetes sync (.+?) path escapes the workspace remote dir: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts","lineNumber":137,"sourceCode":" * inbound, the sync source for outbound) MUST be an absolute path that\n * canonicalizes lexically inside the workspace remote dir; absolute escapes and\n * `..` traversal are rejected fail-closed before any bytes move. Sandbox paths\n * are POSIX.\n */\nexport function assertConfinedSandboxPath(remoteDir: string, candidate: string, label: string): void {\n  const normalizedRoot = path.posix.normalize(remoteDir);\n  const normalized = path.posix.normalize(candidate);\n  if (\n    !path.posix.isAbsolute(normalized) ||\n    normalized === \"..\" ||\n    normalized.includes(\"/../\") ||\n    normalized.endsWith(\"/..\")\n  ) {\n    throw new Error(`Kubernetes sync ${label} path is not a confined absolute path: ${candidate}`);\n  }\n  const prefix = normalizedRoot.endsWith(\"/\") ? normalizedRoot : `${normalizedRoot}/`;\n  if (normalized !== normalizedRoot && !normalized.startsWith(prefix)) {\n    throw new Error(`Kubernetes sync ${label} path escapes the workspace remote dir: ${candidate}`);\n  }\n}\n\n/**\n * True when `relative` (a POSIX path) escapes its anchoring directory once\n * normalized: an absolute path, `..`, or a `..`-leading traversal all break out.\n */\nfunction posixPathEscapes(relative: string): boolean {\n  const normalized = path.posix.normalize(relative);\n  return normalized === \"..\" || normalized.startsWith(\"../\") || path.posix.isAbsolute(normalized);\n}\n\nasync function withHostTempDir<T>(fn: (dir: string) => Promise<T>): Promise<T> {\n  const dir = await fs.mkdtemp(path.join(os.tmpdir(), \"paperclip-k8s-sync-\"));\n  try {\n    return await fn(dir);\n  } finally {\n    await fs.rm(dir, { recursive: true, force: true }).catch(() => undefined);","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts#L119-L155","documentation":"Error \"Kubernetes sync ${label} path escapes the workspace remote dir: ${candidate}\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts:137 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Keep the sync path inside the workspace remote dir; remove '..' or absolute escapes."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}