#10006·TiddlyWiki5

[Report] Some plugins include the file system path when loaded

Author: Arlen22Created Sep 2, 2026Updated Sep 3, 2026
Labelsbugneedswork

After changing the file system path for the source TW5 folders, MWS repackaged the following plugins, indicating they save the file system path somewhere in the plugin.

Generally on server software it is not recommended to expose file system paths for a public server, and while writes on a Node TW5 server are always privileged, reads can be public, so this would leak information about the server to non-privileged users.

/home/user/GitHub/MWS-main/dev/wiki/cache/tiddlywiki/5.3.8/plugins/tiddlywiki/jasmine/plugin.json
/home/user/GitHub/MWS-main/dev/wiki/cache/tiddlywiki/5.3.8/plugins/tiddlywiki/tw5.com-docs/plugin.json
/home/user/GitHub/MWS-main/dev/wiki/cache/tiddlywiki/5.3.8/languages/pl-PL/plugin.json
/home/user/GitHub/MWS-main/dev/wiki/cache/tiddlywiki/5.4.1/plugins/tiddlywiki/jasmine/plugin.json
/home/user/GitHub/MWS-main/dev/wiki/cache/tiddlywiki/5.4.1/languages/pl-PL/plugin.json

The language pl-PL in particular is of note as it is caused by a readme.md file which is contained in the plugin. This causes the file system path to become the title of the tiddler, as no other title is available and no tiddlerdeserializer is registered for the file in boot.js. The markdown parser is not even in the core, so there is no way to read fields from the file. I believe this is an actual bug for the language plugin.

Jasmine is more understandable since it is a test suite framework. I didn't check what there reason there is, but it's probably something similar.

No idea why 5.3.8 was doing that for tw5-docs either, but it appears to have gotten fixed in 5.4.1. Note that those were the only two versions I had installed at the moment, so there could be others.

I'm not sure exactly how I am going to handle it on the MWS side. I might just log a warning to console and remove the parent portion of the path from the title manually. But the issue applies equally to the Node server.

Generally speaking it's not an issue for build servers.

My recommendation would be to change boot.js to only use the portion relative to the tw5 path or the wiki path. Perhaps a startup flag or environment variable should be added to enable this behavior for the roughly two people actually depending on it.