ZIP entry "${baseName}" has an unsafe filename (must be a .j

Error message

ZIP entry "${baseName}" has an unsafe filename (must be a .json file without path traversal)

What it means

Error "ZIP entry "${baseName}" has an unsafe filename (must be a .json file without path traversal)" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/oauth/utils/jsonZipExtract.ts:62

  if (jsonEntries.length === 0) {
    throw new Error("ZIP archive contains no .json files");
  }

  if (jsonEntries.length > maxFiles) {
    throw new Error(
      `ZIP archive contains ${jsonEntries.length} .json files — max allowed is ${maxFiles}`
    );
  }

  let totalBytes = 0;
  const result: ExtractedZipFile[] = [];

  for (const [entryName, data] of jsonEntries) {
    const baseName = path.basename(entryName);

    if (!isSafeEntryName(baseName)) {
      throw new Error(
        `ZIP entry "${baseName}" has an unsafe filename (must be a .json file without path traversal)`
      );
    }

    if (!isSafeEntryName(entryName)) {
      throw new Error(
        `ZIP entry path "${entryName}" is unsafe (no "..", absolute paths, or control characters allowed)`
      );
    }

    if (data.byteLength > maxFileSize) {
      throw new Error(
        `ZIP entry "${baseName}" is ${data.byteLength} bytes — exceeds ${maxFileSize} byte limit per file`
      );
    }

    totalBytes += data.byteLength;
    if (totalBytes > maxTotal) {

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/oauth/utils/jsonZipExtract.ts:62 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/d7576fb11fe72130. Report an issue: GitHub.