quarkusio/quarkus · error · SecurityException

No workspace path provided

Error message

No workspace path provided

What it means

Workspace operations in Dev UI (file creation/editing) resolve client-supplied path URIs against the project root with confinement checks. resolveWorkspacePath throws SecurityException when the supplied URI string is null — no path was provided at all. This guard exists because workspace actions must always target an explicit file inside the project.

Source

Thrown at extensions/devui/deployment/src/main/java/io/quarkus/devui/deployment/menu/WorkspaceProcessor.java:353

            return 9;
        if (name.startsWith("src/integrationTest/"))
            return 10;

        return 11;
    }

    private boolean isFileInRoot(String name) {
        return !name.contains("/");
    }

    /**
     * Resolve a client supplied path URI and make sure it stays confined to the project root.
     * The workspace operations are only meant to act on files inside the user's project, so any
     * path (including ones using {@code ..} or symlinks) that resolves outside the root is rejected.
     */
    private static Path resolveWorkspacePath(Path rootPath, String uriString) {
        if (uriString == null) {
            throw new SecurityException("No workspace path provided");
        }

        Path root;
        Path resolved;
        try {
            root = toCanonicalPath(rootPath);
            resolved = toCanonicalPath(Paths.get(URI.create(uriString)));
        } catch (IllegalArgumentException | FileSystemNotFoundException | IOException e) {
            // Malformed URI, a non-file scheme or a path we cannot safely canonicalize: reject it.
            throw new SecurityException("Invalid workspace path: " + uriString);
        }

        if (!resolved.startsWith(root)) {
            throw new SecurityException("Path is outside the project root: " + resolved);
        }
        return resolved;
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Always supply the file path URI (file: scheme, e.g. file:///home/user/project/src/main/java/App.java) in the request parameters.
2. Check parameter naming in the caller so the path value isn't read from the wrong key.
3. If writing custom tooling, validate the parameter is non-null before invoking the action.
4. Confirm you're calling the intended action that requires a path (some workspace actions differ).

Example fix

// before
params.put("path", null); // or omitted

// after
params.put("path", "file:///home/user/myproject/src/main/resources/application.properties");

if (uriString == null || uriString.isBlank()) {
    throw new IllegalArgumentException("A file: URI under the project root is required");
}

try { Path p = resolveWorkspacePath(root, uri); ... }
catch (SecurityException e) {
    if (e.getMessage().equals("No workspace path provided")) {
        ui.showError("Path parameter is missing");
    } else throw e;
}

When it happens

Trigger: Invoking a Dev UI workspace action (createBuildTimeActions handlers, 'path' action) without passing the path URI parameter, so uriString == null when resolveWorkspacePath is called.

Common situations: Custom tooling or scripts calling the Dev UI workspace JSON-RPC actions without the path argument; a UI bug dropping the parameter; copy-pasted action invocations omitting required params.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Invalid workspace path: ${uriString}
• Path is outside the project root: ${resolved}
• Path is not below the application root: <file>
• Symbolic links are not allowed in remote-dev paths: <file>
• You have to specify a key. This is the key the user will pre

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9a8e4d0385215fde. Report an issue: GitHub.