ruvnet/ruflo · error · Error

Path traversal (..) is not allowed

Error message

Path traversal (..) is not allowed

What it means

validateConfigPath traversal guard: after normalization the relative path still contains '..', meaning it climbs out of the working directory (e.g. ../../etc/passwd). The escape attempt is rejected outright rather than clamped.

Source

Thrown at v3/mcp/tools/config-tools.ts:28

 */

import { z } from 'zod';
import { MCPTool, ToolContext } from '../types.js';
import { resolve, normalize } from 'path';

/**
 * Validate and sanitize config file path to prevent path traversal
 */
function validateConfigPath(inputPath: string, cwd: string = process.cwd()): string {
  // Normalize the path to resolve .. and .
  const normalizedPath = normalize(inputPath);

  // Block absolute paths and paths with traversal
  if (normalizedPath.startsWith('/') || normalizedPath.startsWith('\\')) {
    throw new Error('Absolute paths are not allowed for config files');
  }
  if (normalizedPath.includes('..')) {
    throw new Error('Path traversal (..) is not allowed');
  }

  // Only allow .json and .config.* files
  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];
  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));
  if (!hasAllowedExt) {
    throw new Error('Only .json and .config.* file extensions are allowed');
  }

  // Resolve to absolute path within cwd
  const resolvedPath = resolve(cwd, normalizedPath);

  // Ensure the resolved path is within cwd
  if (!resolvedPath.startsWith(cwd)) {
    throw new Error('Config path must be within current working directory');
  }

  return resolvedPath;

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Remove '..' segments from the config path.
2. Use paths strictly inside the project directory.

When it happens

Trigger: Thrown at v3/mcp/tools/config-tools.ts:28 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/9d7d8e6039354893. Report an issue: GitHub.