RocketChat/Rocket.Chat · error · Meteor.Error

error-invalid-data

error-invalid-data

Error message

Invalid dataURI

What it means

setAvatarFromServiceWithValidation requires a truthy dataURI as its second argument; an empty or undefined value throws error-invalid-data before any setting, permission, or user checks. The dataURI later carries a base64 data-URI string, an http(s) URL (service 'url'), or raw bytes (service 'rest'), but at this guard only emptiness is tested.

Source

Thrown at apps/meteor/server/lib/users/setUserAvatar.ts:26

import type { ClientSession } from 'mongodb';

import { isRenderableImageType } from '../../../lib/renderableImageTypes';
import { onceTransactionCommitedSuccessfully } from '../../database/utils';
import { settings } from '../../settings';
import { hasPermissionAsync } from '../authorization/hasPermission';
import { SystemLogger } from '../logger/system';
import { RocketChatFile } from '../media/file';
import { FileUpload } from '../media/file-upload';

export const setAvatarFromServiceWithValidation = async (
	userId: string,
	dataURI: string,
	contentType?: string,
	service?: string,
	targetUserId?: string,
): Promise<void> => {
	if (!dataURI) {
		throw new Meteor.Error('error-invalid-data', 'Invalid dataURI', {
			method: 'setAvatarFromService',
		});
	}

	if (!userId) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'setAvatarFromService',
		});
	}

	if (!settings.get('Accounts_AllowUserAvatarChange')) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'setAvatarFromService',
		});
	}

	let user: IUser | null;

View on GitHub (pinned to b2c16d5842)

Solutions

1. Require a non-empty avatar payload in the form/API layer before invoking the setter.
2. If the goal is resetting to the default avatar, use service 'initials' with the appropriate call rather than an empty payload.
3. Verify the client actually read the file successfully (check FileReader/fetch results) before submitting.

Example fix

// before
Meteor.call('setAvatarFromService', dataURI ?? '');

// after
if (!dataURI) {
  throw new Error('Select an image first');
}
Meteor.call('setAvatarFromService', dataURI);

if (!dataURI || typeof dataURI !== 'string') {
  throw new Meteor.Error('error-invalid-data', 'Invalid dataURI', { method: 'caller' });
}
// if it looks like a data URI, sanity-check the prefix
if (dataURI.startsWith('data:') && !/^data:[\w./+-]+;base64,/.test(dataURI)) {
  throw new Meteor.Error('error-invalid-data', 'Malformed data URI');
}
await setAvatarFromServiceWithValidation(userId, dataURI, contentType, service, targetUserId);

const hasAvatarPayload = (v: unknown): v is string => typeof v === 'string' && v.length > 0;

When it happens

Trigger: setAvatarFromService(userId, '') from an upload form submitted without a file; API consumers mapping a missing request field to an empty avatar payload; client file read failing silently and sending an empty string.

Common situations: Avatar upload widget allows empty submit; REST body missing the avatar field; client-side FileReader errors swallowed before submit; test harnesses calling the method with no image.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• error-not-allowed
• error-invalid-file-name
• error-invalid-characters-in-file-name
• invalid-user
• error-invalid-user

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/5708bf4b6ec54833. Report an issue: GitHub.