security.input_path_refused

A path the caller supplied was refused


Type	`https://mthds.ai/errors/security.input_path_refused`
Family	`security`: Refusals made for safety. An implementation may also record each one as a security event.
Domain	`input`: the caller acts, by changing the request or its inputs
Retry	`no`: repeating the operation fails the same way
HTTP status	`422`
Raised as	a problem document, sent as the body of an HTTP response or kept in a run's record

What it means

A path the caller supplied, such as a key of a request's files, could escape the root it belongs to.

What to do

Write each path relative to its root, with forward slashes, no .. segment, no colon and no leading slash.

Next steps

A problem carries the step aimed at whoever reads it: the first when its reader is the domain's actor, the caller, and the second for any other reader.

Reader	Kind	Detail
The domain's actor	`change_input`	Write every path of the request relative to its root, with forward slashes, then send the request again.
Any other reader	`change_input`	Pass this to the caller, whose request holds a path that could escape its root.

Detail

The problem's detail is written from this template, filled with the occurrence's parameters:

A path in the request could escape its root (rule: {rule}).

Parameters

Every parameter is present on every occurrence of the code.

Name	Type	Description
`rule`	one of `absolute`, `parent_segment`, `outside_root`, `backslash`, `colon`, `empty`	The rule the path breaks: it is absolute, climbs with a parent segment, lands outside the root, holds a backslash or a colon, or is empty.