googleapis/mcp-toolbox · error

relative path is empty

Error message

relative path is empty

What it means

Guard inside ResolveWithinDir: the relative path argument `rel` is the empty string, so there is no object path to join onto the configured directory.

Source

Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:129

func escapes(dir, target string) (bool, error) {
	within, err := filepath.Rel(dir, target)
	if err != nil {
		return true, err
	}
	return within == ".." || strings.HasPrefix(within, ".."+string(filepath.Separator)) || filepath.IsAbs(within), nil
}

// ResolveWithinDir joins rel onto dir and returns the result only if it stays
// inside dir, both as written and after symlinks are resolved. The returned
// path is the cleaned join, not the symlink-resolved target, so callers keep
// reporting the location the user asked for.
func ResolveWithinDir(dir, rel string) (string, error) {
	cleanDir, err := ValidateLocalPath(dir)
	if err != nil {
		return "", fmt.Errorf("directory %q is invalid: %w", dir, err)
	}
	if rel == "" {
		return "", fmt.Errorf("relative path is empty")
	}
	if filepath.IsAbs(rel) {
		return "", fmt.Errorf("path %q must be relative", rel)
	}

	cleanDest := filepath.Clean(filepath.Join(cleanDir, rel))
	out, err := escapes(cleanDir, cleanDest)
	if err != nil {
		return "", fmt.Errorf("path %q cannot be resolved within %q: %w", rel, cleanDir, err)
	}
	if out {
		return "", fmt.Errorf("path %q escapes configured directory %q", rel, cleanDir)
	}

	// Repeat the check against the real targets. A symlink under cleanDir can
	// point anywhere, so the name-level check above proves nothing on its own.
	resolvedDir, err := ResolveSymlinks(cleanDir)
	if err != nil {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Pass a non-empty relative object path (e.g. 'folder/object.txt')
2. Leave the parameter unset instead of sending an empty string

When it happens

Trigger: Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:129 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/85c50db9ebb7dd88. Report an issue: GitHub.