Security Messages
See Errors & Warnings Catalog for the full index, and Errors & Warnings Guide for a narrative explanation of message categories, exit codes, and common fixes.
Messages from security checks, including path validation, traversal detection, and Unicode safety enforcement.
| Message | Exit Code | Hint |
|---|---|---|
| 🚨 Absolute path not allowed: [path] | 9 | 💡 Use a relative path from your source directory instead of an absolute path |
| 🚨 Cannot remove root directory: [path] | 9 | 💡 SSI will never remove the filesystem root — check your deploy path configuration |
| 🚨 Deploy directory is a symlink: [path] 🔒 SECURITY: SSI will not deploy to symlinked directories 💡 Use a real directory path, not a symlink 📋 This prevents attackers from tricking SSI into writing to unintended locations | 9 | 💡 If you use atomic deployment, the symlink should point to the deployment, not be the deploy directory itself |
| 🚨 Path is empty or resolves to the current directory: [path] | 9 | 💡 Provide a non-empty relative path — empty strings and bare '.' paths collapse to the current directory |
| 🚨 External path access denied: [path] 💡 Use --allow-external-paths for [source] if you understand the risks | 9 | 💡 External paths require both a config option on the step AND a CLI flag for safety |
| 🚨 Step [step] ([emoji]): Missing required CLI flag for external path in '[field]' field: [path] 💡 Step [step] has options = ["allow-external-paths"] but CLI flag is missing 📋 Add to command: --allow-external-paths ⚠️ Dual-flag security: BOTH the config option AND CLI flag are required | 9 | 💡 The config option is already set — add --allow-external-paths to your command to complete the dual-flag requirement |
| 🚨 Step [step] ([emoji]): Missing required config option for external path in '[field]' field: [path] 💡 CLI flag --allow-external-paths provided but step [step] lacks the option 📋 Add to step [step]: options = ["allow-external-paths"] ⚠️ Dual-flag security: BOTH the config option AND CLI flag are required | 9 | 💡 The CLI flag is set — add options = ["allow-external-paths"] to the step in ssi-config.toml |
| 🚨 Step [step] ([emoji]): Absolute path not allowed in '[field]' field: [path] 💡 External paths require BOTH config option AND CLI flag 📋 Add to step [step]: options = ["allow-external-paths"] 📋 Add to command: --allow-external-paths ⚠️ Security: This allows the step to access files outside your site directory | 9 | 💡 The dual-flag design ensures external path access is always an intentional, explicit choice |
| 🚨 External path [path] found in [emoji] ([path hint]) ⚠️ This file is outside the site root directory 💡 Use --allow-external-paths flag and add 'allow-external-paths' to options to allow external files | 9 | 💡 External paths require both a config option on the step AND a CLI flag for safety |
| 🚨 File source '[source]' has 'allow-external-paths' in options ⚠️ Security-sensitive: allowing external paths for [source] means symlinks can escape source directory 💡 You must ALSO provide --allow-external-paths CLI flag for source '[source]' 📋 Dual-flag requirement for [source] prevents accidental security vulnerabilities | 9 | 💡 The dual-flag design ensures external path access is always an intentional, explicit choice |
| 🚨 Path does not end with .blue or .green: [path] | 9 | 💡 Blue-green deployment directories must end with '.blue' or '.green' (e.g., ~/public_html/mysite.blue) |
| 🚨 Null byte in path rejected: [path] | 9 | 💡 On Linux, paths containing null bytes are silently truncated by the kernel — this is a security hazard and SSI rejects them explicitly |
| 🚨 Deployment path contains a traversal component (..): [path] | 9 | 💡 Provide an absolute deployment path without any '..' components — a valid deployment path ends in a .blue or .green suffix with no parent-directory escapes |
| 🚨 Path must be absolute for security check: [path] | 9 | 💡 This is an internal error — the path should have been resolved to an absolute path before the security check |
| 🚨 Parent directory references not allowed in source paths: '[path]' | 9 | 💡 Remove ../ components from the path — all source paths must stay within the site directory |
| 🚨 Step [step] ([emoji]): Missing required CLI flag for parent directory path in '[field]' field: [path] 💡 Step [step] has options = ["allow-external-paths"] but CLI flag is missing 📋 Add to command: --allow-external-paths ⚠️ Dual-flag security: BOTH the config option AND CLI flag are required | 9 | 💡 The config option is already set — add --allow-external-paths to your command to complete the dual-flag requirement |
| 🚨 Step [step] ([emoji]): Missing required config option for parent directory path in '[field]' field: [path] 💡 CLI flag --allow-external-paths provided but step [step] lacks the option 📋 Add to step [step]: options = ["allow-external-paths"] ⚠️ Dual-flag security: BOTH the config option AND CLI flag are required | 9 | 💡 The CLI flag is set — add options = ["allow-external-paths"] to the step in ssi-config.toml |
| 🚨 Step [step] ([emoji]): Parent directory path not allowed in '[field]' field: [path] 💡 External paths require BOTH config option AND CLI flag 📋 Add to step [step]: options = ["allow-external-paths"] 📋 Add to command: --allow-external-paths ⚠️ Security: This allows the step to access files outside your site directory | 9 | 💡 The dual-flag design ensures external path access is always an intentional, explicit choice |
| 🚨 Preserve-from directory is a symlink: [path] 🔒 SECURITY: SSI will not preserve from symlinked directories 💡 Use a real directory path with --preserve-from, not a symlink 📋 This prevents attackers from tricking SSI into reading from unintended locations | 9 | 💡 Resolve the symlink and use the real directory path for --preserve-from |
| 🚨 Cannot write to protected system directory: [path] 💡 Please choose a web-accessible directory, such as ~/public_html | 9 | 💡 SSI blocks writes to system directories (/etc, /usr, /bin, etc.) to prevent accidental damage |
| 🚨 Cannot read from protected system directory: [path] 💡 System directories like /etc, /dev, /proc, and /sys are always off-limits, even with --allow-external-paths | 9 | 💡 This restriction cannot be overridden — copy the needed files to your source directory instead |
| 🚨 Path rejected during source access: [path] (filesystem security check failed) | 9 | 💡 This often means a symlink, traversal, or similar rule blocked reading this path — check the path and whether --allow-external-paths or step options are required |
| 🚨 Bidirectional control character (U+[error code]) in 💬source_path, line [line] | 9 | 💡 Bidi controls can reverse the visual order of text — used in Trojan Source attacks to make malicious code look benign. Remove the character. |
| 🚨 Byte Order Mark at offset [offset] in 💬source_path, line [line] | 9 | 💡 A BOM (U+FEFF) is only valid at the start of a file — remove the misplaced BOM |
| 🚨 C0 control character (U+[error code]) in 💬source_path, line [line] | 9 | 💡 C0 control characters (non-printable ASCII, U+0000–U+001F and U+007F) cause rendering hazards and can confuse parsers. Remove the character or replace with the appropriate whitespace. |
| 🚨 C1 control character (U+[error code]) in 💬source_path, line [line] | 9 | 💡 C1 control characters (U+0080–U+009F) are 8-bit non-printable characters with no legitimate use in UTF-8 HTML source — they cause rendering hazards in some parsers. Remove the character. |
| 🚨 Excessive combining characters in 💬source_path, line [line] (found: 💬quantity_found, limit: [max] per base) | 9 | 💡 Excessive combining characters may indicate a combining character attack — reduce combining marks per base character |
| 🚨 Format control character (U+[error code]) in 💬source_path, line [line] | 9 | 💡 Format control characters include invisible steganographic lookalikes (tag block U+E0001, U+E0020–U+E007F) and invisible line/paragraph separators (U+2028, U+2029). TAG block characters look like ASCII but are invisible — only valid inside subdivision flag sequences (England, Scotland, and Wales emoji). Remove the character. |
| 🚨 Standalone zero-width joiner (U+[error code]) in 💬source_path, line [line] | 9 | 💡 Zero Width Joiner (U+200D) outside an emoji sequence is invisible and has no legitimate use in HTML source. Remove the character. |
| 🚨 Tag variation selector (U+[error code]) in 💬source_path, line [line] | 9 | 💡 Tag variation selectors (U+E0100–U+E01EF) encode hidden bytes invisibly inside emoji sequences — steganographic injection. Remove the character. |
| 🚨 Zero-width character (U+[error code]) in 💬source_path, line [line] | 9 | 💡 Zero-width characters are invisible and can hide content or confuse parsers. Remove the character. |
| 🚨 Symlink chain too deep at [path] — exceeded maximum hop limit or OS-detected circular chain 🔒 SECURITY: A chain this deep indicates a likely symlink loop attack 💡 SSI limits symlink chain depth to match git and the Linux kernel | 9 | 💡 The depth limit rejects symlink chains of 41 or more links |
| 🚨 Symlink [link] points outside site directory to [target] 💡 You must ALSO provide --allow-external-paths CLI flag for source '[source]' 📋 Note: Server configuration may prevent symlink '[link]' from working - verify it resolves correctly | 9 | 💡 Prefer copying the target into your source tree; if you must point outside, add options = ["allow-external-paths"] to the step and pass --allow-external-paths. |
| 🚨 Path could not be resolved on disk: '[path]' | 9 | 💡 The path contains .. components but an intermediate directory does not exist — ensure all path components exist, or use a fully resolved path without .. |
| 🚨 Write path escaped the deploy-directory boundary: [path] 🔒 SECURITY: write target is outside the configured deploy root 💬paths_deploy_dir 💡 This indicates a programming error in SSI — all write paths should be constructed via deploy_dir.join() | 9 | 💡 If you see this error, please report it as a bug — it should never occur in normal operation |