overleaf/overleaf · error · Errors.InvalidNameError

invalid --dest value

Error message

invalid --dest value

What it means

After normalization, the target path must pass SafePath.isCleanPath(), Overleaf's guard against unsafe/invalid project paths (traversals, illegal characters, reserved names, relative segments). A plain Error with this message is thrown when the normalized destination fails that check, since such a path could never be a valid entity name in the project tree.

Source

Thrown at services/web/scripts/upload_file.mjs:128

    throw new Error(`local path is not a file: ${localPath}`)
  }

  const rawDestPath = opts.destPath ?? Path.basename(localPath)
  let targetPath
  try {
    targetPath = normalizeTargetPath(rawDestPath)
  } catch (error) {
    const invalidValue =
      opts.destPath !== undefined
        ? `--dest=${JSON.stringify(opts.destPath)}`
        : `derived basename ${rawDestPath} from FILE ${localPath}`
    throw new Error(
      `provide a non-empty destination project path; invalid value ${invalidValue}`
    )
  }

  if (!SafePath.isCleanPath(targetPath)) {
    throw new Errors.InvalidNameError('invalid --dest value')
  }

  const fileName = Path.posix.basename(targetPath)
  if (!fileName || fileName === '.' || fileName === '..') {
    throw new Error('destination path must include a file name')
  }

  return { ...opts, targetPath }
}

async function confirmUpload(projectId, localPath, targetPath, assumeYes) {
  if (assumeYes) {
    return true
  }

  const rl = readline.createInterface({ input, output })
  try {
    const answer = await rl.question(

View on GitHub (pinned to 28ad3b03b7)

Solutions

1. Rewrite --dest as a clean POSIX path: forward slashes only, no '..' or '.' segments, no illegal characters, e.g. /figures/plot.png.
2. Sanitize the filename programmatically (strip/replace invalid characters) before invoking the script.
3. Convert Windows paths: replace backslashes with '/' and drop the drive letter.

Example fix

// before
node scripts/upload_file.mjs /tmp/plot.png --dest="C:\figures\plot.png" ...
// after
node scripts/upload_file.mjs /tmp/plot.png --dest="/figures/plot.png" ...

const clean = (p) => p.replace(/\\/g, '/').split('/').filter(s => s && s !== '.' && s !== '..').join('/')
const dest = '/' + clean(rawDest)
// then verify no illegal characters remain before invoking the script

const isCleanPosixPath = (p) => typeof p === 'string' && !p.includes('\\') && !p.split('/').includes('..') && !/[\u0000-\u001f*?:"<>|]/.test(p);

try {
  await runUpload(opts)
} catch (err) {
  if (err.message === 'invalid --dest value') { console.error('Rewrite --dest as a clean POSIX path without .. or illegal characters'); process.exit(1) }
  throw err
}

When it happens

Trigger: --dest containing '..' segments, Windows drive letters or backslashes, illegal characters (e.g. *, ?, :, control chars), leading/trailing whitespace remnants, or names SafePath rejects (e.g. '.git'-style reserved names).

Common situations: Copying a Windows path (C:\data\plot.png) directly into --dest; including './' or '../' components; filenames with characters illegal in Overleaf projects produced by another tool.

Related errors

• destination path must include a file name
• bad docId: usage: $ node scripts/remove_deleted_docs.js [DOC
• Date must be in YYYY-MM-DD format
• Invalid strategy: ${strategy}
• Usage: node verify_sampled_projects.mjs [--startDate <start>

AI-assisted analysis of overleaf/overleaf@28ad3b03b7 (2026-09-03). Data as JSON: /api/errors/b1c6c53533001059. Report an issue: GitHub.