tinyhumansai/openhuman · error

dest_path may not contain '..'

Error message

dest_path may not contain '..'

What it means

A component of dest_path is ParentDir ('..'), which would climb out of the downloads directory; the jail rejects it during component-by-component validation.

Source

Thrown at src/openhuman/tools/impl/network/curl.rs:68

    /// `<workspace>/<dest_subdir>`. Rejects absolute paths, `..`
    /// segments, and any other escape attempts.
    fn resolve_dest(&self, dest: &str) -> anyhow::Result<PathBuf> {
        let trimmed = dest.trim();
        if trimmed.is_empty() {
            anyhow::bail!("dest_path cannot be empty");
        }

        let p = Path::new(trimmed);
        if p.is_absolute() {
            anyhow::bail!("dest_path must be relative — got absolute path");
        }

        for component in p.components() {
            match component {
                Component::Normal(_) => {}
                Component::CurDir => {}
                Component::ParentDir => {
                    anyhow::bail!("dest_path may not contain '..'");
                }
                Component::Prefix(_) | Component::RootDir => {
                    anyhow::bail!("dest_path must be relative");
                }
            }
        }

        let root = self.workspace_dir.join(&self.dest_subdir);
        let resolved = root.join(p);

        // Belt-and-braces: ensure the resolved path still lives under root.
        // Lexical check is sufficient because we already rejected `..`.
        if !resolved.starts_with(&root) {
            anyhow::bail!("dest_path resolves outside the downloads root");
        }

        Ok(resolved)
    }

View on GitHub (pinned to 7491200858)

Solutions

1. Remove '..' segments from dest_path
2. Reference the desired location directly under the downloads root

When it happens

Trigger: Thrown at src/openhuman/tools/impl/network/curl.rs:68 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/72a449f292dcfca2. Report an issue: GitHub.