Function validateVectorStorePath

packages/components/src/validator.ts:212–286

(userProvidedPath: string | undefined)

 * @throws {Error} If path validation fails or path is outside allowed directories
 */
export const validateVectorStorePath = (userProvidedPath: string | undefined): string => {
    if (process.env.PATH_TRAVERSAL_SAFETY === 'false') {
        if (!userProvidedPath || userProvidedPath.trim() === '') {
            return path.join(getUserHome(), '.flowise', 'vectorstore')
        }
        const bypassPath = userProvidedPath.trim()
        return path.isAbsolute(bypassPath) ? bypassPath : path.resolve(path.join(getUserHome(), '.flowise', bypassPath))
    }

    // If no path provided, use default secure location
    if (!userProvidedPath || userProvidedPath.trim() === '') {
        return path.join(getUserHome(), '.flowise', 'vectorstore')
    }

    const basePath = userProvidedPath.trim()

    // Check for explicit path traversal patterns (..)
    if (basePath.includes('..')) {
        throw new Error('Invalid path: path traversal attempt detected')
    }

    // Check for URL-encoded path traversal
    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {
        throw new Error('Invalid path: encoded path traversal attempt detected')
    }

    // Check for null bytes and control characters
    if (/\0/.test(basePath) || /[\x00-\x1f]/.test(basePath)) {
        throw new Error('Invalid path: null bytes or control characters detected')
    }

    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)
    // This prevents cross-platform attack vectors
    if (/^[a-zA-Z]:\\/.test(basePath)) {
        throw new Error('Invalid path: Windows absolute paths are not allowed')
    }
    if (/^\\\\[^\\]/.test(basePath)) {
        throw new Error('Invalid path: UNC paths are not allowed')
    }
    if (/^\\\\\?\\/.test(basePath)) {
        throw new Error('Invalid path: Extended-length paths are not allowed')
    }

    // Resolve to absolute path
    // If path is relative, resolve it relative to the .flowise directory (safe default)
    // If path is already absolute, keep it as-is
    let resolvedPath: string
    if (path.isAbsolute(basePath)) {
        resolvedPath = path.resolve(basePath)
    } else {
        // Relative paths are resolved within the .flowise directory for safety
        resolvedPath = path.resolve(path.join(getUserHome(), '.flowise', basePath))
    }

    // Verify the resolved path doesn't contain '..' after resolution
    if (resolvedPath.includes('..')) {
        throw new Error('Invalid path: path traversal detected in resolved path')
    }