{"record":{"id":"fc50a2a72b736fa7","repo":"elastic/elasticsearch","slug":"path-must-be-absolute","errorCode":null,"errorMessage":"'path' [{}] must be absolute","messagePattern":"'path' \\[(.+?)\\] must be absolute","errorType":"validation","errorClass":"PolicyValidationException","httpStatus":null,"severity":"error","filePath":"libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java","lineNumber":289,"sourceCode":"            if (settingBaseDirAsString != null && pathSetting == null) {\n                throw new PolicyValidationException(\"'basedir_if_relative' may only be used with 'path_setting'\");\n            }\n\n            final FileData fileData;\n            if (relativePathAsString != null) {\n                if (relativeTo == null) {\n                    throw new PolicyValidationException(\"files entitlement with a 'relative_path' must specify 'relative_to'\");\n                }\n                BaseDir baseDir = parseBaseDir(relativeTo);\n                Path relativePath = Path.of(relativePathAsString);\n                if (FileUtils.isAbsolutePath(relativePathAsString)) {\n                    throw new PolicyValidationException(\"'relative_path' [\" + relativePathAsString + \"] must be relative\");\n                }\n                fileData = FileData.ofRelativePath(relativePath, baseDir, mode);\n            } else if (pathAsString != null) {\n                Path path = Path.of(pathAsString);\n                if (FileUtils.isAbsolutePath(pathAsString) == false) {\n                    throw new PolicyValidationException(\"'path' [\" + pathAsString + \"] must be absolute\");\n                }\n                fileData = FileData.ofPath(path, mode);\n            } else if (pathSetting != null) {\n                if (settingBaseDirAsString == null) {\n                    throw new PolicyValidationException(\"files entitlement with a 'path_setting' must specify 'basedir_if_relative'\");\n                }\n                BaseDir baseDir = parseBaseDir(settingBaseDirAsString);\n                fileData = FileData.ofPathSetting(pathSetting, baseDir, mode);\n            } else {\n                throw new AssertionError(\"File entry validation error\");\n            }\n            filesData.add(fileData.withPlatform(platform).withExclusive(exclusive));\n        }\n        return new FilesEntitlement(filesData);\n    }\n}\n","sourceCodeStart":271,"sourceCodeEnd":306,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java#L271-L306","documentation":"Thrown when the `path` field resolves to a non-absolute path. The `path` branch is reserved for fully-qualified filesystem paths; a relative value cannot be safely resolved by the entitlement system and is rejected — relative paths must use `relative_path` plus `relative_to` instead.","triggerScenarios":"An entry sets `path` to a value that FileUtils.isAbsolutePath reports as non-absolute on the host OS (no leading slash on Unix, no drive letter on Windows).","commonSituations":"Author uses `path` for a relative value by mistake; cross-platform issue where a Unix path is interpreted on Windows; missing leading slash; mis-paste of a partial path.","solutions":["If the path is meant to be relative, switch to `relative_path` plus `relative_to`.","If the path is meant to be absolute, prefix it with the root (leading `/` on Unix, `<DRIVE>:\\` on Windows)."],"exampleFix":"// before\n{ \"path\": \"var/log/es\", \"mode\": \"read\" }\n\n// after (option A: absolute)\n{ \"path\": \"/var/log/es\", \"mode\": \"read\" }\n// after (option B: relative)\n{ \"relative_path\": \"var/log/es\", \"relative_to\": \"home\", \"mode\": \"read\" }","handlingStrategy":"validation","validationCode":"public static void validatePathIsAbsolute(String path) {\n    if (!Path.of(path).isAbsolute()) {\n        throw new IllegalArgumentException(\"path must be absolute: \" + path);\n    }\n}","typeGuard":"public static boolean isAbsolute(String p) {\n    return Path.of(p).isAbsolute();\n}","tryCatchPattern":null,"preventionTips":["Ensure `path` values start with `/` on Unix or `<DRIVE>:\\` on Windows.","If the path is relative, switch to relative_path + relative_to.","Use a JSON Schema pattern enforcing an absolute-path shape."],"tags":["entitlements","files","policy","validation","paths","platform"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}