Skip to content

upsert error with "Folder with Files" module due to "Path traversal detected" when specifying ANY path. #5861

@mbreiden

Description

@mbreiden

Describe the bug

I can't get the "Folder with Files" module to work. It doesn't matter which kind of path I enter

I use ./Path which exists in /root as /root/Path for the "Folder with Files" module and have ./ in the "Faiss" module which works without any issues and stores the information in root. (BTW: the docker file in docker runs FlowwiseAI still as root)

It looks like a merge concerning a security vulnerability changed the logic behind the isPathTraversal detection, which breaks the modul.

There is a discussion #5326 which might have a solution but the implementation of the isPathTraversal code is broken.

Especially if you allow other modules to NOT use it.. Flowise should either restrict access to anything outside the directory it is running in or don't bother at all. Relying on others to implement security is a bad approach.

Running this in a docker container, setup via die documention.. which is the reason I used the docker files from the docker directory.

To Reproduce

Add the "Folder with Files" module
Add a directory with files inside the root or "node?" folder
Configure the "Folder with Files" with ./directory
Try to run it

Expected behavior

It works without a pathtraversal error.
For more information see referenced discussion.

Screenshots

No response

Flow

No response

Use Method

Docker

Flowise Version

No response

Operating System

macOS

Browser

Chrome

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions