{"id":"efede1593eca2103","repo":"gofiber/fiber","slug":"invalid-path","errorCode":null,"errorMessage":"invalid path","messagePattern":"invalid path","errorType":"validation","errorClass":"ErrInvalidPath","httpStatus":null,"severity":"warning","filePath":"middleware/static/static.go","lineNumber":23,"sourceCode":"\t\"errors\"\n\t\"fmt\"\n\t\"io/fs\"\n\t\"net/url\"\n\t\"os\"\n\tpathpkg \"path\"\n\t\"path/filepath\"\n\t\"slices\"\n\t\"strconv\"\n\t\"strings\"\n\t\"sync\"\n\n\t\"github.com/gofiber/utils/v2\"\n\t\"github.com/valyala/fasthttp\"\n\n\t\"github.com/gofiber/fiber/v3\"\n)\n\nvar ErrInvalidPath = errors.New(\"invalid path\")\n\nconst invalidPathSentinel = \"/__fiber_invalid__\"\n\nfunc bytesToPathString(p []byte) string {\n\tif bytes.IndexByte(p, '\\\\') >= 0 {\n\t\tb := make([]byte, len(p))\n\t\tcopy(b, p)\n\t\tfor i := range b {\n\t\t\tif b[i] == '\\\\' {\n\t\t\t\tb[i] = '/'\n\t\t\t}\n\t\t}\n\t\treturn utils.UnsafeString(b)\n\t}\n\n\treturn utils.UnsafeString(p)\n}\n","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/middleware/static/static.go#L5-L41","documentation":"Declared as ErrInvalidPath in static/static.go and returned internally by sanitizePath / unescapePathString when a request path is unsafe: invalid percent-encoding, backslashes, NUL bytes, parent-directory (..) traversal, a leading '//', a Windows volume name, or a drive letter like 'C:'. It is a path-traversal / path-confusion guard. In the handler the error is not returned to the client; the path is rewritten to invalidPathSentinel so fasthttp responds 404.","triggerScenarios":"Requests such as GET /..%2f..%2fetc/passwd, GET /%00, GET \\server\\share (backslash), GET //etc/passwd, or GET /C:/Windows/system32 against a static.New root. sanitizePath rejects these; the client sees a 404, and any NotFoundHandler runs.","commonSituations":"Scanners/bots probing for path traversal; clients sending raw backslashes on Windows-rooted deployments; misconfigured reverse proxies forwarding unnormalized paths; legitimate (but unusual) encoded paths that trip the guards.","solutions":["Treat occurrences as expected security behavior — no action needed; the 404 is the correct response.","If a legitimate asset path is rejected, simplify/normalize the URL (remove //, backslashes, or unnecessary percent-encoding) at the client/cdn level.","Set Config.NotFoundHandler to serve a custom 404 or index.html for SPA fallback if needed.","Confirm the asset actually exists under root and the request method is GET/HEAD (other methods skip the handler)."],"exampleFix":"// before\napp.Use(\"/assets\", static.New(\"./public\"))\n\n// after — graceful SPA fallback for rejected/missing paths\napp.Use(\"/assets\", static.New(\"./public\", static.Config{\n    NotFoundHandler: func(c fiber.Ctx) error {\n        return c.SendFile(\"./public/index.html\")\n    },\n}))","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"// The handler converts ErrInvalidPath into a 404 automatically; handle it there.\napp.Use(\"/assets\", static.New(\"./public\", static.Config{\n    NotFoundHandler: func(c fiber.Ctx) error {\n        return c.Status(fiber.StatusNotFound).SendString(\"not found\")\n    },\n}))","preventionTips":["Treat 404s from path-traversal probes as expected behavior — do not 'fix' the guard.","Normalize client URLs (remove //, backslashes, stray percent-encoding) if legitimate assets 404.","Use Config.NotFoundHandler for SPA index.html fallback."],"tags":["static","path-traversal","security","validation"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}