Foundry376/Mailspring · error

Quick preview cannot access this directory: ${filePath}

Error message

Quick preview cannot access this directory: ${filePath}

What it means

Security guard in the quickpreview main-process IPC: after path.resolve on both sides, the requested file path does not lie under {configDirPath}/files, so the read is refused. This blocks directory-traversal payloads (e.g. ../../) from the quickpreview renderer reaching arbitrary files on disk.

Source

Thrown at app/src/browser/quickpreview-ipc.ts:52

  // Only allow requests from the quickpreview renderer.html
  if (!pathname.endsWith('/src/quickpreview/renderer.html')) {
    throw new Error('Invalid IPC sender: request not from quickpreview renderer');
  }
};

/**
 * Validate that a file path is within the allowed files directory.
 * Uses path.resolve() to prevent directory traversal attacks.
 */
const checkPathIsWithinFiles = (filePath: string): string => {
  const baseDir = path.join(global.application.configDirPath, 'files');
  const resolvedBase = path.resolve(baseDir);
  const resolvedTarget = path.resolve(filePath);

  // Ensure resolved path is within the allowed directory
  // Append path.sep to prevent prefix-matching attacks (e.g., /files-evil/)
  if (!resolvedTarget.startsWith(resolvedBase + path.sep)) {
    throw new Error(`Quick preview cannot access this directory: ${filePath}`);
  }

  return resolvedTarget;
};

const getFilePath = (url: string) => {
  const { filePath } = JSON.parse(decodeURIComponent(new URL(url).search.slice(1)));
  return checkPathIsWithinFiles(filePath);
};

const previewFileAsString = (event: IpcMainInvokeEvent, { truncate } = { truncate: false }) => {
  validateSender(event);
  const filepath = getFilePath(event.sender.getURL());
  let raw = fs.readFileSync(filepath).toString();
  if (truncate) raw = raw.substr(0, 1000);
  return raw;
};

View on GitHub (pinned to 648c685d60)

Solutions

1. Regenerate the preview URL from the app itself — hand-edited or stale URLs with traversal sequences will be rejected by design
2. If legitimate previews fail, check that configDirPath hasn't changed (e.g. after a data directory migration)

When it happens

Trigger: Thrown at app/src/browser/quickpreview-ipc.ts:52 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Foundry376/Mailspring@648c685d60 (2026-09-03). Data as JSON: /api/errors/2aa7421cb14d94d3. Report an issue: GitHub.