hasura/graphql-engine · error

the fullPath %q does not extend the sub-fullPath %q: %w

Error message

the fullPath %q does not extend the sub-fullPath %q: %w

What it means

Emitted when the resolved plugin binary path (installDir joined with platform.Bin) does not lie inside the plugin's installation directory, as verified by IsSubPath. This is a path-traversal guard: a plugin spec whose bin field escapes the install dir (e.g. ../../evil) or is absolute would otherwise let the installer link an arbitrary executable into the bin directory.

Source

Thrown at cli/plugins/plugins.go:340

			fmt.Errorf("failed to get the absolute fullPath of %q: %w", installDir, err),
		)
	}

	fullPath := filepath.Join(installDir, filepath.FromSlash(platform.Bin))

	pathAbs, err := filepath.Abs(fullPath)
	if err != nil {
		return errors.E(
			op,
			fmt.Errorf("failed to get the absolute fullPath of %q: %w", fullPath, err),
		)
	}

	if _, ok := IsSubPath(subPathAbs, pathAbs); !ok {
		if err != nil {
			return errors.E(
				op,
				fmt.Errorf(
					"the fullPath %q does not extend the sub-fullPath %q: %w",
					fullPath,
					installDir,
					err,
				),
			)
		}

		return nil
	}

	err = createOrUpdateLink(binDir, fullPath, plugin.Name)
	if err != nil {
		return errors.E(op, fmt.Errorf("failed to link installed plugin: %w", err))
	}

	return nil
}

View on GitHub (pinned to 724551b9ae)

Solutions

1. Inspect the plugin spec's platforms[].bin — it must be a plain relative path under the archive root
2. Reinstall from the official plugin index or a trusted source
3. If you maintain the spec, change bin to a relative path like bin/myplugin and re-publish
4. If the path looks valid, report the bug — the check can also misfire on Windows path separators and wraps a nil error

Example fix

// before (plugin spec)
"platforms": [{"bin": "../../usr/bin/tailshell"}]
// after
"platforms": [{"bin": "bin/tailshell-linux-amd64"}]

installDir := paths.PluginVersionInstallPath(p.Name, p.Version)
bin := filepath.Join(installDir, filepath.FromSlash(p.Bin))
if _, ok := plugins.IsSubPath(installDir, bin); !ok {
    return fmt.Errorf("plugin %s bin escapes install dir", p.Name)
}

if err := plugins.Install(p, platform); err != nil {
    if strings.Contains(err.Error(), "does not extend the sub-fullPath") {
        // reject/migrate this plugin spec; do not trust its bin field
    }
}

When it happens

Trigger: Config.Install or Config.Upgrade of a plugin whose spec declares platform.Bin as an absolute path or one containing ../ segments that resolve outside PluginVersionInstallPath(name, version). Note the guard is inverted/buggy (err is nil at this point) so the %w wraps a nil error.

Common situations: Installing a third-party/malicious plugin index with a crafted bin field; a plugin spec authored on Windows with backslashes that defeat the FromSlash+Join containment check; hand-edited local plugin manifests.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• can't move, move target %v is not a subpath from=%q, to=%q
• can't move, move target %v is out of bounds from=%q, to=%q
• plugin name %q not allowed
• could not get files using a glob string: %w
• no files in the plugin archive matched the glob pattern=%s

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/cb0fb4fe8c5f91dd. Report an issue: GitHub.