grafana/grafana · warning · PathValidationError

Error validating request path

Error message

Error validating request path

What it means

Thrown as PathValidationError('Error validating request path') by the catch block in the path validator when URI decoding itself fails (e.g. a '%' not followed by two hex digits). Malformed encodings are treated as suspicious and rejected as potential traversal/smuggling attempts rather than being silently passed through.

Source

Thrown at packages/grafana-data/src/text/sanitize.ts:178

    }

    // Validate the entire decoded string for traversal attempts
    // This prevents attacks that use query separators to hide traversal payloads
    if (/\.\.|\/\\|[\t\n\r]/.test(decoded)) {
      throw new PathValidationError();
    }

    // Return the original path (not the decoded version) to preserve the full URL
    return path;
  } catch (err) {
    // Rethrow the original PathValidationError to preserve the stack trace
    if (err instanceof PathValidationError) {
      throw err;
    }

    // A decoding error can happen with malformed URIs (e.g., % not followed by hex).
    // These are suspicious, so we treat them as traversal attempts.
    throw new PathValidationError('Error validating request path');
  }
}

export const textUtil = {
  escapeHtml,
  hasAnsiCodes,
  sanitize,
  sanitizeTextPanelContent,
  sanitizeUrl,
  sanitizeSVGContent,
  sanitizeTrustedTypes,
  sanitizeTrustedTypesRSS,
};

View on GitHub (pinned to ae3104e369)

Solutions

  1. Properly percent-encode literal '%' as '%25' before passing the path to the sanitizer.
  2. Validate and repair encoding upstream (encodeURIComponent on dynamic segments) so the path is well-formed.
  3. Catch PathValidationError and show a friendly error to the user instead of letting it propagate.
  4. Reject paths containing a lone '%' at the input boundary.

Example fix

// before
sanitizeUrl('/download/50%off');
// after
sanitizeUrl('/download/50%25off');
Defensive patterns

Strategy: try-catch

Validate before calling

import { PathValidationError, textUtil } from '@grafana/data';

function sanitizeOrFallback(url: string): string {
  try {
    return textUtil.sanitizeUrl(url);
  } catch (e) {
    if (e instanceof PathValidationError) return '';
    throw e;
  }
}

Type guard

function isWellFormedUri(s: string): boolean {
  try { decodeURIComponent(s); return true; } catch { return false; }
}

Try / catch

try {
  clean = textUtil.sanitizeUrl(input);
} catch (e) {
  if (e instanceof PathValidationError) {
    // malformed encoding - treat as invalid URL
    clean = '';
  } else throw e;
}

Prevention

When it happens

Trigger: Calling the sanitizer on a path containing a stray '%' not followed by valid hex, or any other malformed percent-encoding that makes decodeURIComponent throw. Examples: '/a%2', '/foo%zz', '/%'.

Common situations: User input or scraped content with a literal percent sign that was never encoded as %25; truncated URLs; copy-paste from a source that broke the encoding; buggy URL construction that interpolates raw values.

Related errors

AI-assisted analysis of grafana/grafana@ae3104e369 (2026-08-12). Data as JSON: /api/errors/3c38c52a09e7f823. Report an issue: GitHub.