langflow-ai/langflow · warning · HTTPException

Invalid {label}. Use a simple {label} without directory path

Error message

Invalid {label}. Use a simple {label} without directory paths or '..'.

What it means

HTTP 400 from _get_validated_path_segment (used for file and folder name query params) when the supplied value contains '..', '/', or '\\'. It is a path-traversal guard: names used for component/file/folder endpoints must be a single path segment with no separators or parent references.

Source

Thrown at src/backend/base/langflow/api/utils/core.py:63

        "set_cookie",
    }
)

MAX_PAGE_SIZE = 50
MIN_PAGE_SIZE = 1

CurrentActiveUser = Annotated[User, Depends(get_current_active_user)]
CurrentActiveMCPUser = Annotated[User, Depends(get_current_active_user_mcp)]
# DbSession with auto-commit for write operations
DbSession = Annotated[AsyncSession, Depends(injectable_session_scope)]
# DbSessionReadOnly for read-only operations (no auto-commit, reduces lock contention)
DbSessionReadOnly = Annotated[AsyncSession, Depends(injectable_session_scope_readonly)]


def _get_validated_path_segment(value: str, *, label: str = "name") -> str:
    """Validate a path segment to prevent path traversal attacks."""
    if ".." in value or "/" in value or "\\" in value:
        raise HTTPException(
            status_code=400,
            detail=f"Invalid {label}. Use a simple {label} without directory paths or '..'.",
        )
    return value


def _get_validated_file_name(file_name: str = Path()) -> str:
    return _get_validated_path_segment(file_name, label="file name")


def _get_validated_folder_name(folder_name: str = Path()) -> str:
    return _get_validated_path_segment(folder_name, label="folder name")


ValidatedFileName = Annotated[str, Depends(_get_validated_file_name)]
ValidatedFolderName = Annotated[str, Depends(_get_validated_folder_name)]

# Message to raise if we're in an Astra cloud environment and a component or endpoint is not supported

View on GitHub (pinned to 976ec789d2)

Solutions

1. Send only the final path segment (basename) as file_name/folder_name
2. Strip slashes and '..' client-side before the call: name.split('/').pop()
3. If legitimate nested paths are needed, use an endpoint that accepts full paths by design, not these segment-validated params

Example fix

# before
GET /api/v1/component/file?file_name=my_folder/my_component.py  # 400
# after
GET /api/v1/component/file?file_name=my_component.py

const safeSegment = (name) => {
  if (/[\\/]/.test(name) || name.includes('..')) throw new Error('invalid segment');
  return name.split('/').pop();
};

const isSafePathSegment = (s) => typeof s === 'string' && s.length > 0 && !s.includes('/') && !s.includes('\\') && !s.includes('..');

When it happens

Trigger: Calling endpoints whose file_name/folder_name FastAPI dependency uses _get_validated_file_name/_get_validated_folder_name with values like '../etc/passwd', 'sub/dir/file.py', or 'a\\b'.

Common situations: Clients passing full relative paths instead of bare names; imports/scripts generating names from user text containing slashes; security scanners probing traversal payloads.

Related errors

• Invalid file entry
• Invalid file path format
• Invalid filename
• Invalid fs_path: directory traversal (..) is not allowed
• Invalid path

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/8f5a591c6b435d39. Report an issue: GitHub.