microsoft/aspire · error · ArgumentException

The path must not contain ".." segments.

Error message

The path must not contain ".." segments.

What it means

After rejecting absolute paths, the same validator splits the path on '/' and rejects any '..' segment. These are virtual Docker container paths, so Path.GetFullPath can't normalize them portably; '..' segments could escape the intended container directory and are therefore blocked outright with an ArgumentException.

Solutions

1. Remove '..' segments and pass a path rooted inside the app directory (e.g. "dist", "out/app").
2. Copy shared artifacts into the app directory instead of traversing to them.
3. Normalize the path yourself before calling, ensuring no segment equals "..".

Example fix

// before
options.OutputPath = "../shared/dist";
// after
options.OutputPath = "dist";

static bool HasNoTraversal(string? path) =>
    !string.IsNullOrEmpty(path) && path.Split('/', StringSplitOptions.RemoveEmptyEntries).All(s => s != "..");

bool HasNoTraversal(string? path) => !string.IsNullOrEmpty(path) && path.Split('/', StringSplitOptions.RemoveEmptyEntries).All(s => s != "..");

try { options.OutputPath = p; } catch (ArgumentException ex) when (ex.Message.Contains("..\" segments")) { /* collapse or rewrite the path */ }

When it happens

Trigger: Passing paths containing '..' such as "../shared", "dist/../../out", or paths where normalization would produce '..' (e.g. "a/../b" segments surviving split validation).

Common situations: Attempting to reference a sibling project directory from a container path; copy-pasted relative paths with traversal; trying to write output outside the app directory in the generated Dockerfile.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• The Next.js config file
• The path must be a relative path.
• No Next.js configuration file found. AddNextJsApp expects…
• The apiPath must contain only URL-safe path characters…
• A JSON Patch path can only traverse objects and arrays.

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/31fa0538093f9046. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.JavaScript/JavaScriptHostingExtensions.cs:3252

        {
            normalizedPath = normalizedPath[2..];
        }

        if (normalizedPath.StartsWith('/'))
        {
            throw new ArgumentException("The path must be a relative path.", nameof(path));
        }

        // Reject path traversal segments. These are virtual Docker container paths (not host
        // filesystem paths), so Path.GetFullPath cannot be used — it produces platform-specific
        // results (e.g. D:\app\dist on Windows). Segment-based validation works correctly
        // cross-platform for container paths.
        var segments = normalizedPath.Split('/', StringSplitOptions.RemoveEmptyEntries);
        foreach (var segment in segments)
        {
            if (segment == "..")
            {
                throw new ArgumentException("The path must not contain \"..\" segments.", nameof(path));
            }
        }

        return string.Join('/', segments);
    }

    /// <summary>
    /// Resolves the Node.js version to use for a project by checking common configuration files.
    /// </summary>
    /// <param name="workingDirectory">The working directory of the Node.js project.</param>
    /// <param name="logger">The logger for diagnostic messages.</param>
    /// <returns>The resolved Node.js major version number as a string.</returns>
    private static string ResolveNodeVersion(string workingDirectory, ILogger logger)
    {
        // Follow the same shape as Cloud Native Buildpacks-style tooling for Node selection:
        // pinned toolchain files (.nvmrc, .node-version, .tool-versions) are treated as
        // authoritative runtime intent, while package.json engines.node is compatibility
        // metadata rather than a deployment image pin. If there is no explicit toolchain pin,

View on GitHub (pinned to 25830f84bd)