iflytek/astron-agent · error · OutboundPolicyError

Tool path parameter is unsafe

Error message

Tool path parameter is unsafe

What it means

Path parameter values that could escape the endpoint path are rejected before substitution. Values equal to '.' or '..', containing '/' or '\\', or containing control characters (< 0x20) would allow path traversal or URL structure manipulation, so the library raises OutboundPolicyError('Tool path parameter is unsafe') and fails the request closed.

Solutions

1. Sanitize or split the value at the caller: pass only the path segment (e.g. the file name or ID), not a full path
2. If the value legitimately contains slashes, encode it beforehand as a single identifier (e.g. base64 or URL-safe encoding) and decode server-side
3. Validate parameter values against an allow-list pattern before invoking the tool

Example fix

// before
path = {"name": "../../etc/passwd"}
// after
path = {"name": quote(os.path.basename(user_input), safe="")}

def is_safe_path_segment(value):
    v = str(value)
    return bool(v) and v not in ('.', '..') and '/' not in v and '\\' not in v and all(ord(c) >= 0x20 for c in v)

try:
    result = await run.do_call(span)
except CallThirdApiException as e:
    if 'path parameter is unsafe' in str(e.err):
        raise InvalidUserInput('path parameter rejected') from e
    raise

When it happens

Trigger: do_call → _build_url with a path parameter whose string value is '.', '..', contains a forward slash or backslash (e.g. '../admin', 'a/b', 'C:\\temp'), or includes control characters such as newline or tab.

Common situations: User-controlled input passed straight into a tool path parameter without sanitization; values pulled from file paths or Windows paths; injection attempts in chat-driven tool calls.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Path must stay inside the Skill workspace
• 21600
• -40001
• auth name: , auth value
• CODE_EXECUTION_ERROR

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/d27ed67ce913537b. Report an issue: GitHub.

Appendix: source

Thrown at core/plugin/link/infra/tool_exector/process.py:131

        url = self.server

        # Substitute OpenAPI path parameters as individual path segments. urljoin is unsafe here:
        # an absolute value, a scheme-relative value, or a dot segment can replace/escape the
        # persisted endpoint path.
        for name, value in self.path.items():
            placeholder = "{" + str(name) + "}"
            if placeholder not in url:
                raise OutboundPolicyError(
                    f"Tool path parameter has no matching placeholder: {name}"
                )
            raw_value = str(value)
            if (
                raw_value in {".", ".."}
                or "/" in raw_value
                or "\\" in raw_value
                or any(ord(character) < 0x20 for character in raw_value)
            ):
                raise OutboundPolicyError("Tool path parameter is unsafe")
            url = url.replace(placeholder, quote(raw_value, safe=""))

        if _PATH_PARAMETER_PATTERN.search(url):
            raise OutboundPolicyError("Tool URL has unresolved path parameters")

        # Authentication method selection and URL construction
        if self._is_authorization_md5:
            url = public_query_url(url)
            if self.query:
                url = url + "&" + "&".join([f"{k}={v}" for k, v in self.query.items()])
        elif self._is_auth_hmac:
            url, headers = assemble_ws_auth_url(
                url, self.method, self.auth_con_js, self.body
            )
            self.header = headers
        else:
            if self.query:
                url = url + "?" + "&".join([f"{k}={v}" for k, v in self.query.items()])

View on GitHub (pinned to 5e758547a8)