googleapis/mcp-toolbox · error

path %q must be relative

Error message

path %q must be relative

What it means

Guard inside ResolveWithinDir: filepath.IsAbs(rel) is true, meaning the caller supplied an absolute path where only a path relative to the configured directory is allowed.

Source

Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:132

		return true, err
	}
	return within == ".." || strings.HasPrefix(within, ".."+string(filepath.Separator)) || filepath.IsAbs(within), nil
}

// ResolveWithinDir joins rel onto dir and returns the result only if it stays
// inside dir, both as written and after symlinks are resolved. The returned
// path is the cleaned join, not the symlink-resolved target, so callers keep
// reporting the location the user asked for.
func ResolveWithinDir(dir, rel string) (string, error) {
	cleanDir, err := ValidateLocalPath(dir)
	if err != nil {
		return "", fmt.Errorf("directory %q is invalid: %w", dir, err)
	}
	if rel == "" {
		return "", fmt.Errorf("relative path is empty")
	}
	if filepath.IsAbs(rel) {
		return "", fmt.Errorf("path %q must be relative", rel)
	}

	cleanDest := filepath.Clean(filepath.Join(cleanDir, rel))
	out, err := escapes(cleanDir, cleanDest)
	if err != nil {
		return "", fmt.Errorf("path %q cannot be resolved within %q: %w", rel, cleanDir, err)
	}
	if out {
		return "", fmt.Errorf("path %q escapes configured directory %q", rel, cleanDir)
	}

	// Repeat the check against the real targets. A symlink under cleanDir can
	// point anywhere, so the name-level check above proves nothing on its own.
	resolvedDir, err := ResolveSymlinks(cleanDir)
	if err != nil {
		return "", fmt.Errorf("directory %q cannot be resolved: %w", cleanDir, err)
	}
	resolvedDest, err := ResolveSymlinks(cleanDest)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Strip the leading slash and send the path relative to destination_dir
2. Configure destination_dir to the intended absolute root and keep object paths relative

When it happens

Trigger: Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:132 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/f0e009b62eb81c83. Report an issue: GitHub.