ZIP entry path "${entryName}" is unsafe (no "..", absolute p

Error message

ZIP entry path "${entryName}" is unsafe (no "..", absolute paths, or control characters allowed)

What it means

Error "ZIP entry path "${entryName}" is unsafe (no "..", absolute paths, or control characters allowed)" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/oauth/utils/jsonZipExtract.ts:68

    throw new Error(
      `ZIP archive contains ${jsonEntries.length} .json files — max allowed is ${maxFiles}`
    );
  }

  let totalBytes = 0;
  const result: ExtractedZipFile[] = [];

  for (const [entryName, data] of jsonEntries) {
    const baseName = path.basename(entryName);

    if (!isSafeEntryName(baseName)) {
      throw new Error(
        `ZIP entry "${baseName}" has an unsafe filename (must be a .json file without path traversal)`
      );
    }

    if (!isSafeEntryName(entryName)) {
      throw new Error(
        `ZIP entry path "${entryName}" is unsafe (no "..", absolute paths, or control characters allowed)`
      );
    }

    if (data.byteLength > maxFileSize) {
      throw new Error(
        `ZIP entry "${baseName}" is ${data.byteLength} bytes — exceeds ${maxFileSize} byte limit per file`
      );
    }

    totalBytes += data.byteLength;
    if (totalBytes > maxTotal) {
      throw new Error(`ZIP archive total uncompressed size exceeds ${maxTotal} byte limit`);
    }

    const content = new TextDecoder("utf-8").decode(data);
    result.push({ name: baseName, content });
  }

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/oauth/utils/jsonZipExtract.ts:68 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/09ea2569911661d7. Report an issue: GitHub.