FlowiseAI/Flowise · error · Error

Invalid file name: name is required

Error message

Invalid file name: name is required

What it means

Thrown by sanitizeFileName() in the Flowise validator when the `name` argument is missing (undefined/null/empty) or not a string. sanitizeFileName is the security gate that strips path-traversal payloads from untrusted file names before they reach storage, so it refuses to operate on input it cannot safely reason about. The guard runs before any prefix-stripping, decoding, or basename extraction, meaning no normalization occurs until the argument passes a type+truthiness check.

Source

Thrown at packages/components/src/validator.ts:410

    if (!/^(SELECT|WITH)\b/i.test(trimmed)) {
        throw new Error('Invalid SQL statement: only read-only SELECT/WITH statements are allowed')
    }

    if (/load_extension\s*\(/i.test(trimmed)) {
        throw new Error('Invalid SQL statement: load_extension is not allowed')
    }
}

/**
 * Sanitize a file name to prevent path traversal attacks.
 * Strips common storage prefixes, extracts the basename, runs it through
 * the `sanitize-filename` package, and rejects anything that still looks unsafe.
 *
 * @param {string} name The file name to sanitize
 */
export const sanitizeFileName = (name: string): string => {
    if (!name || typeof name !== 'string') {
        throw new Error('Invalid file name: name is required')
    }
    // Strip the FILE-STORAGE:: prefix if present
    let stripped = name.replace(/^FILE-STORAGE::/, '')
    // Decode percent-encoded traversal sequences before basename extraction
    try {
        stripped = decodeURIComponent(stripped)
    } catch (_) {
        // If decoding fails the raw string is fine — basename will still strip dirs
    }
    // Normalize backslashes to forward slashes so path.basename works on all
    // platforms (on Linux, path.basename does not treat \ as a separator)
    stripped = stripped.replace(/\\/g, '/')
    // Extract only the base filename — removes all directory components
    let baseName = path.basename(stripped)
    // Run through sanitize-filename to strip OS-reserved chars, control chars, etc.
    baseName = sanitize(baseName)
    // Remove leading dots to prevent hidden files or relative path references
    baseName = baseName.replace(/^\.+/, '')

View on GitHub (pinned to abe4a8601a)

Solutions

1. Ensure the caller passes a non-empty string: validate filename presence at the request boundary (e.g. in the multer field config or controller) before forwarding to sanitizeFileName.
2. Default to a generated safe name when the upstream source has none, e.g. `name = name || crypto.randomUUID()`.
3. If the value is genuinely optional, branch around the call instead of letting it reach the guard.
4. Add a TypeScript type annotation or runtime check so non-string values are caught at the caller, not inside the sanitizer.

Example fix

// before
const safe = sanitizeFileName(req.body.fileName) // req.body.fileName may be undefined

// after
if (!req.body.fileName || typeof req.body.fileName !== 'string') {
    return res.status(400).json({ message: 'fileName is required' })
}
const safe = sanitizeFileName(req.body.fileName)

if (!name || typeof name !== 'string' || name.length === 0) {
    return res.status(400).json({ message: 'A non-empty file name is required' })
}
const safe = sanitizeFileName(name)

const isNonEmptyString = (v: unknown): v is string =>
    typeof v === 'string' && v.length > 0

try {
    const safe = sanitizeFileName(name)
} catch (e) {
    // name was missing/non-string — reject the request, do not retry with the same input
    return res.status(400).json({ message: (e as Error).message })
}

When it happens

Trigger: Calling sanitizeFileName(undefined), sanitizeFileName(null), sanitizeFileName(''), sanitizeFileName(123), or sanitizeFileName(<an object>) directly. Also reached indirectly when a storage provider or upload handler forwards a missing req.file.originalname / form field value into this function without first checking it.

Common situations: An upload endpoint where the client omitted the filename field; a storage provider that reads a key from a payload whose schema changed; a migration that introduced sanitizeFileName into a code path that previously tolerated undefined names; test fixtures that call the function with no argument.

Related errors

• Invalid file path: key is required and must be a string
• Failed to parse Supabase filter: ${error.message}
• Invalid or unsafe file name: ${name}
• Invalid evaluator type
• Invalid input array

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/6af12f9d1e33dc21. Report an issue: GitHub.