projectdiscovery/nuclei · error

normalize output file %q: %w

Error message

normalize output file %q: %w

What it means

With -allow-local-file-access enabled, normalizeOutputFile places relative output paths under the OS temp dir and then calls filepath.Abs; this error wraps an Abs failure on that branch. filepath.Abs almost never fails on Linux (its main failure is a deleted working directory or an invalid path); on Windows, overlong paths or illegal characters can trigger it.

Source

Thrown at pkg/js/libs/krbforge/krbforge.go:216

	}, nil
}

func normalizeOutputFile(executionID string, outputFile string) (string, error) {
	if outputFile == "" || outputFile == "-" {
		return outputFile, nil
	}

	if protocolstate.IsLfaAllowed(&types.Options{ExecutionId: executionID}) {
		// Preserve the existing relative-path behavior when
		// -allow-local-file-access is enabled: avoid implicit CWD writes by
		// placing relative ccache paths in temp.
		if !filepath.IsAbs(outputFile) {
			outputFile = filepath.Join(os.TempDir(), outputFile)
		}

		normalized, err := filepath.Abs(outputFile)
		if err != nil {
			return "", fmt.Errorf("normalize output file %q: %w", outputFile, err)
		}

		return normalized, nil
	}

	normalized := outputFile
	if !filepath.IsAbs(normalized) {
		normalized = filepath.Join(config.DefaultConfig.GetTemplateDir(), normalized)
	}

	normalized, err := filepath.Abs(normalized)
	if err != nil {
		return "", fmt.Errorf("normalize output file %q: %w", outputFile, err)
	}

	if filepathutil.IsPathWithinDirectory(normalized, config.DefaultConfig.GetTemplateDir()) {
		return normalized, nil
	}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Pass an absolute output path so Abs has nothing fragile to resolve
2. Sanitize the filename: strip NUL and control characters, keep the full path within OS limits
3. If the template removed its working directory, write to an absolute temp path instead

function safeOutputPath(p) {
  if (p === '-' || !p) return p;
  if (/[\x00-\x1f]/.test(p)) throw new Error('output path contains control characters');
  if (p.length > 200) throw new Error('output path too long');
  return p;
}
safeOutputPath(outputFile);

When it happens

Trigger: The process working directory was removed while the template ran; the output_file string contains NUL bytes, control characters, or exceeds platform path limits; exotic filesystem states making absolute-path resolution fail.

Common situations: Templates that delete or move their own CWD before forging a ticket; unvalidated user input flowing into the outputFile argument of CreateSilverTicket; Windows path-length limits (260 chars) with deep temp-dir nesting.

Related errors

• path %v is outside nuclei-template directory and -allow-loca
• spn is required for silver ticket
• invalid TicketRequest: %w
• outputFile must be a string
• ipv4 and/or ipv6 must be selected

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/76cd94cfb6a467a0. Report an issue: GitHub.