zeroclaw-labs/zeroclaw · error · anyhow::Error

Slack attachment save directory escapes workspace: {}

Error message

Slack attachment save directory escapes workspace: {}

What it means

Error "Slack attachment save directory escapes workspace: {}" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-channels/src/slack.rs:3310

            anyhow::Error::msg(format!("invalid attachment filename: {file_name}"))
        })?;

        tokio::fs::create_dir_all(workspace).await?;
        let workspace_root = tokio::fs::canonicalize(workspace)
            .await
            .unwrap_or_else(|_| workspace.to_path_buf());

        let save_dir = workspace.join(SLACK_ATTACHMENT_SAVE_SUBDIR);
        tokio::fs::create_dir_all(&save_dir).await?;
        let resolved_save_dir = tokio::fs::canonicalize(&save_dir).await.with_context(|| {
            format!(
                "failed to resolve Slack attachment save directory: {}",
                save_dir.display()
            )
        })?;

        if !resolved_save_dir.starts_with(&workspace_root) {
            anyhow::bail!(
                "Slack attachment save directory escapes workspace: {}",
                resolved_save_dir.display()
            );
        }

        Ok(resolved_save_dir.join(safe_name))
    }

    fn sanitize_attachment_filename(file_name: &str) -> Option<String> {
        let basename = Path::new(file_name).file_name()?.to_str()?.trim();
        if basename.is_empty() || basename == "." || basename == ".." {
            return None;
        }

        let sanitized: String = basename
            .replace(['/', '\\'], "_")
            .chars()
            .take(SLACK_ATTACHMENT_FILENAME_MAX_CHARS)

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Configure the Slack attachment save directory inside the workspace; remove path traversal components from the configured path.

When it happens

Trigger: Thrown at crates/zeroclaw-channels/src/slack.rs:3310 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/a54490fbbb3523b2. Report an issue: GitHub.