microsoft/semantic-kernel · error · FunctionExecutionException

Path '{path}' contains a dot-segment, which could lead to pa

Error message

Path '{path}' contains a dot-segment, which could lead to path traversal.

What it means

A security validation: `_validate_path_segments` rejects any operation path containing dot-segments (`.` or `..`), including percent-encoded forms like `%2e%2e`. This prevents path traversal attacks where an interpolated argument or spec path could escape the intended URL hierarchy. The check decodes percent-encoding up to five levels deep and re-splits on encoded separators to catch obfuscated traversal attempts.

Source

Thrown at python/semantic_kernel/connectors/openapi_plugin/models/rest_api_operation.py:343

                if parameter.is_required:
                    raise FunctionExecutionException(
                        f"No argument is provided for the `{parameter.name}` "
                        f"required parameter of the operation - `{self.id}`."
                    )
                continue
            path_template = path_template.replace(f"{{{parameter.name}}}", quote(str(argument), safe=""))
        self._validate_path_segments(path_template)
        return path_template

    @staticmethod
    def _validate_path_segments(path: str) -> None:
        """Reject dot-segments (. or ..), including percent-encoded forms, that enable path traversal.

        The operation is selected using the raw path but the request URL is built from a canonicalized
        path, so encoded dot-segments such as "%2e%2e" must be rejected before the URL is constructed.
        """
        if RestApiOperation._contains_dot_segment(path):
            raise FunctionExecutionException(
                f"Path '{path}' contains a dot-segment, which could lead to path traversal."
            )

    @staticmethod
    def _contains_dot_segment(path: str) -> bool:
        """Return True if the path contains a dot-segment (. or ..), including percent-encoded forms.

        Used both to reject such paths when building a request URL and to exclude them during operation
        selection so an encoded dot-segment cannot bypass an include/exclude operation-selection filter.
        """
        if not path:
            return False
        for segment in path.split("/"):
            decoded = segment
            for _ in range(5):
                unescaped = unquote(decoded)
                if unescaped == decoded:
                    break

View on GitHub (pinned to c028a0c7dc)

Solutions

Sanitize path parameter values to remove `.` and `..` segments before passing them as arguments.
Reject or validate user input that contains path traversal sequences.
Review the OpenAPI spec for any path templates containing dot-segments and correct them.

Example fix

// before (user-supplied path param with traversal)
await api.get_file(file_id="../../etc/passwd")
// after
# validate/sanitize input before calling
import re
clean = re.sub(r'(\.+/)+', '', file_id)
await api.get_file(file_id=clean)

Defensive patterns

Strategy: validation

Validate before calling

import re
def sanitize_path_segment(value: str) -> str:
    """Reject or strip dot-segments from a path parameter value."""
    from urllib.parse import unquote
    decoded = value
    for _ in range(5):
        nxt = unquote(decoded)
        if nxt == decoded:
            break
        decoded = nxt
    for part in decoded.replace('\\', '/').split('/'):
        if part in ('.', '..'):
            raise ValueError(f"Path value '{value}' contains a dot-segment (path traversal)")
    return value

Try / catch

try:
    result = await api.my_operation(**args)
except FunctionExecutionException as e:
    if "dot-segment" in str(e):
        # sanitize the offending path parameter value
        ...

Prevention

Sanitize all user-supplied path parameter values for dot-segments before passing them.
Reject input containing '.', '..', or percent-encoded equivalents.
Review OpenAPI spec path templates for accidental dot-segments.

When it happens

Trigger: A path argument value or operation path template contains `.` or `..` segments, or percent-encoded equivalents (`%2e`, `%2e%2e`, `%2E%2E`). This can come from user-supplied path parameter values being interpolated into the URL path.

Common situations: A path parameter value like `../admin` or `..%2f..%2fconfig` supplied by a user or client. An OpenAPI spec path template inadvertently contains dot-segments. Security testing / fuzzing of the API.

Related errors

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/510d9608cb9bde51. Report an issue: GitHub.