RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-data

error-invalid-data

Error message

Invalid dataURI

What it means

setAvatarFromServiceWithValidation requires a truthy dataURI as its second argument; an empty or undefined value throws error-invalid-data before any setting, permission, or user checks. The dataURI later carries a base64 data-URI string, an http(s) URL (service 'url'), or raw bytes (service 'rest'), but at this guard only emptiness is tested.

Solutions

1. Require a non-empty avatar payload in the form/API layer before invoking the setter.
2. If the goal is resetting to the default avatar, use service 'initials' with the appropriate call rather than an empty payload.
3. Verify the client actually read the file successfully (check FileReader/fetch results) before submitting.

Example fix

// before
Meteor.call('setAvatarFromService', dataURI ?? '');

// after
if (!dataURI) {
  throw new Error('Select an image first');
}
Meteor.call('setAvatarFromService', dataURI);

if (!dataURI || typeof dataURI !== 'string') {
  throw new Meteor.Error('error-invalid-data', 'Invalid dataURI', { method: 'caller' });
}
// if it looks like a data URI, sanity-check the prefix
if (dataURI.startsWith('data:') && !/^data:[\w./+-]+;base64,/.test(dataURI)) {
  throw new Meteor.Error('error-invalid-data', 'Malformed data URI');
}
await setAvatarFromServiceWithValidation(userId, dataURI, contentType, service, targetUserId);

const hasAvatarPayload = (v: unknown): v is string => typeof v === 'string' && v.length > 0;

When it happens

Trigger: setAvatarFromService(userId, '') from an upload form submitted without a file; API consumers mapping a missing request field to an empty avatar payload; client file read failing silently and sending an empty string.

Common situations: Avatar upload widget allows empty submit; REST body missing the avatar field; client-side FileReader errors swallowed before submit; test harnesses calling the method with no image.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• error-avatar-invalid-content-type
• error-invalid-characters-in-file-name
• error-invalid-desired-user
• error-invalid-file
• error-invalid-file-name

AI-assisted analysis of RocketChat/Rocket.Chat@2a7de45707 (2026-08-18). Data as JSON: /api/errors/5708bf4b6ec54833. Report an issue: GitHub.

Appendix: source

Thrown at apps/meteor/server/lib/users/setUserAvatar.ts:26

import type { ClientSession } from 'mongodb';

import { isRenderableImageType } from '../../../lib/renderableImageTypes';
import { onceTransactionCommitedSuccessfully } from '../../database/utils';
import { settings } from '../../settings';
import { hasPermissionAsync } from '../authorization/hasPermission';
import { SystemLogger } from '../logger/system';
import { RocketChatFile } from '../media/file';
import { FileUpload } from '../media/file-upload';

export const setAvatarFromServiceWithValidation = async (
	userId: string,
	dataURI: string,
	contentType?: string,
	service?: string,
	targetUserId?: string,
): Promise<void> => {
	if (!dataURI) {
		throw new Meteor.Error('error-invalid-data', 'Invalid dataURI', {
			method: 'setAvatarFromService',
		});
	}

	if (!userId) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'setAvatarFromService',
		});
	}

	if (!settings.get('Accounts_AllowUserAvatarChange')) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'setAvatarFromService',
		});
	}

	let user: Pick<IUser, '_id' | 'username'> | null;

View on GitHub (pinned to 2a7de45707)