siyuan-note/siyuan · error

content template path is outside templates directory

Error message

content template path is outside templates directory

What it means

Returned by resolveDocContentTemplatePath (template.go:715) when the lexically-resolved absolute path is not a sub-path of <data>/templates/ (gulu.File.IsSubPath check fails). This catches '..' traversal that survived the initial structural guard but still escapes the templates root after filepath.Join and filepath.Clean.

Source

Thrown at kernel/model/template.go:715

			strings.HasPrefix(key, "custom-") {
			tree.Root.SetIALAttr(key, value)
		}
	}
	tree.Root.SetIALAttr("updated", util.CurrentTimeSecondsStr())
	return indexWriteTreeUpsertQueue(tree)
}

func resolveDocContentTemplatePath(templatePath string) (string, error) {
	templatePath = strings.TrimPrefix(filepath.ToSlash(strings.TrimSpace(templatePath)), "/")
	cleanPath := filepath.Clean(filepath.FromSlash(templatePath))
	if "" == cleanPath || "." == cleanPath || filepath.IsAbs(cleanPath) || ".." == cleanPath ||
		strings.HasPrefix(cleanPath, ".."+string(os.PathSeparator)) {
		return "", errors.New("invalid content template path")
	}
	templateRoot := filepath.Join(util.DataDir, "templates")
	absPath := filepath.Join(templateRoot, cleanPath)
	if !gulu.File.IsSubPath(templateRoot, absPath) {
		return "", errors.New("content template path is outside templates directory")
	}
	if !filelock.IsExist(absPath) {
		return "", fmt.Errorf("content template [%s] not found", templatePath)
	}
	realRoot, err := filepath.EvalSymlinks(templateRoot)
	if nil != err {
		return "", err
	}
	realPath, err := filepath.EvalSymlinks(absPath)
	if nil != err {
		return "", err
	}
	info, err := os.Stat(realPath)
	if nil != err || !info.Mode().IsRegular() {
		return "", fmt.Errorf("content template [%s] is not a regular file", templatePath)
	}
	if !gulu.File.IsSubPath(realRoot, realPath) {
		return "", errors.New("content template path is outside templates directory")

View on GitHub (pinned to 251596fc0d)

Solutions

1. Use a simple relative filename for the content template (e.g. 'meeting.md'), no subdirectories that traverse upward.
2. Validate input paths before persisting them in the doc config: reject any segment equal to '..'.
3. If legitimate subdirectories are needed, keep them under templates/ (e.g. 'sub/tpl.md').

Example fix

// before — traversal escapes after join
resolveDocContentTemplatePath("a/../../../etc/x")

// after — stays inside templates/
resolveDocContentTemplatePath("a/tpl.md")

import "path/filepath"
import "gulu/file"

func isInsideTemplatesRoot(p string) bool {
    root := filepath.Join(util.DataDir, "templates")
    abs := filepath.Join(root, filepath.Clean(filepath.FromSlash(p)))
    return gulu.File.IsSubPath(root, abs)
}

When it happens

Trigger: A path like 'sub/../../../other' that, after Clean+Join against util.DataDir/templates, resolves above the templates directory. Distinct from the symlink check (932) — this is the lexical/pre-symlink guard.

Common situations: Crafted traversal in the template path field; a path with many '..' segments; imported documents whose template path was not sanitized upstream.

Related errors

• path escapes templates dir: %s
• template path is outside templates directory
• invalid content template path
• path [%s] must not contain '..'
• path [%s] escapes box directory

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/cfaae308a243128e. Report an issue: GitHub.