ruvnet/ruflo · error · Error

Absolute paths are not allowed for config files

Error message

Absolute paths are not allowed for config files

What it means

validateConfigPath normalization guard: the config file path begins with '/' or '\\', i.e. the caller supplied an absolute path. Config tool paths must be relative to the working directory so the file stays inside the project, so absolute inputs are rejected before any traversal checks.

Source

Thrown at v3/mcp/tools/config-tools.ts:25

 * - config/validate - Validate configuration
 *
 * Implements ADR-005: MCP-First API Design
 */

import { z } from 'zod';
import { MCPTool, ToolContext } from '../types.js';
import { resolve, normalize } from 'path';

/**
 * Validate and sanitize config file path to prevent path traversal
 */
function validateConfigPath(inputPath: string, cwd: string = process.cwd()): string {
  // Normalize the path to resolve .. and .
  const normalizedPath = normalize(inputPath);

  // Block absolute paths and paths with traversal
  if (normalizedPath.startsWith('/') || normalizedPath.startsWith('\\')) {
    throw new Error('Absolute paths are not allowed for config files');
  }
  if (normalizedPath.includes('..')) {
    throw new Error('Path traversal (..) is not allowed');
  }

  // Only allow .json and .config.* files
  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];
  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));
  if (!hasAllowedExt) {
    throw new Error('Only .json and .config.* file extensions are allowed');
  }

  // Resolve to absolute path within cwd
  const resolvedPath = resolve(cwd, normalizedPath);

  // Ensure the resolved path is within cwd
  if (!resolvedPath.startsWith(cwd)) {
    throw new Error('Config path must be within current working directory');

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Pass a relative path within the working directory instead of an absolute path.
2. Resolve the path against the project root before calling the tool.

When it happens

Trigger: Thrown at v3/mcp/tools/config-tools.ts:25 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/b174a22496b37597. Report an issue: GitHub.