DTK0028: Path Outside Workspace Root (Open in Editor)

Package: @vitejs/devtools

Message

Path is outside the workspace root

Cause

The vite:core:open-in-editor RPC function received a file path that, when resolved against the workspace root, points to a location outside the workspace root directory. This is a security restriction to prevent the DevTools client from opening arbitrary files on the host machine. The check resolves the path using path.resolve() and then verifies that the relative path from the workspace root does not start with .. and does not contain null bytes.

Example

// From the DevTools client, calling the open-in-editor RPC
await rpc.call('vite:core:open-in-editor', '../../etc/passwd')
// Throws DTK0028 because the path escapes the workspace root

await rpc.call('vite:core:open-in-editor', '/absolute/path/outside/workspace')
// Throws DTK0028 if this path is not within the workspace root

Fix

Ensure the path passed to the open-in-editor function is within the workspace root. Use relative paths from the project root, or absolute paths that resolve to a location inside the workspace.

// Use a relative path within the project
await rpc.call('vite:core:open-in-editor', 'src/main.ts')

// Or an absolute path that is inside the workspace root
await rpc.call('vite:core:open-in-editor', '/workspace/project/src/main.ts')

If you need to open files outside the workspace, this is intentionally disallowed for security. The workspace root is determined by context.workspaceRoot.

Source

packages/core/src/node/rpc/public/open-in-editor.ts