SillyTavern/SillyTavern · warning

Bad Request

Error message

Bad Request

What it means

getFileNameValidationFunction returns a middleware that inspects a named body field (default 'avatar_url') and rejects requests where the value contains path separators or null bytes, as defined by forbiddenRegExp (slash, backslash on Windows, and \x00). On a match it logs the offending handle/path/field/value and returns HTTP 400. This is a path-traversal / null-byte-injection prevention guard applied before the value is used as a filename.

Source

Thrown at src/middleware/validateFileName.js:35

 * @returns {import('express').RequestHandler} Middleware function
 */
export function getFileNameValidationFunction(fieldName) {
    /**
    * Validates the field in the request body.
    * @param {import('express').Request} req Request object
    * @param {import('express').Response} res Response object
    * @param {import('express').NextFunction} next Next middleware
    */
    return function validateAvatarUrlMiddleware(req, res, next) {
        if (req.body && fieldName in req.body && (typeof req.body[fieldName] === 'string' || hasToString(req.body[fieldName]))) {
            if (forbiddenRegExp.test(req.body[fieldName])) {
                console.error('An error occurred while validating the request body', {
                    handle: req.user.profile.handle,
                    path: req.originalUrl,
                    field: fieldName,
                    value: req.body[fieldName],
                });
                return res.sendStatus(400);
            }
        }

        next();
    };
}

const avatarUrlValidationFunction = getFileNameValidationFunction('avatar_url');
export default avatarUrlValidationFunction;

View on GitHub (pinned to 8172dcd0ee)

Solutions

1. Send only a bare filename (no / or \ or NUL) in the avatar_url field — strip path components client-side before submitting.
2. If the value is legitimately a URL, route it to a URL-handling endpoint, not a filename-validated one.
3. Inspect the server log line 'An error occurred while validating the request body' to see the exact rejected value and field.

Example fix

// before — client sends a path
{ "avatar_url": "uploads/avatar.png" }
// after — send only the bare filename
{ "avatar_url": "avatar.png" }

// Client side: strip path components before sending a filename field
function toBareFilename(value) {
  // keep only the last path segment and remove NUL bytes
  return String(value).replace(/\x00/g, '').split(/[\\/]/).pop();
}
body.avatar_url = toBareFilename(body.avatar_url);

When it happens

Trigger: A POST/PUT request whose JSON body contains { "avatar_url": "../secret" } or { "avatar_url": "foo/bar.png" } or a value with an embedded NUL byte, hitting a route guarded by avatarUrlValidationFunction (or any middleware produced by getFileNameValidationFunction with a different field name).

Common situations: A client sends a relative or absolute path in avatar_url instead of a bare filename; a malicious probe attempting directory traversal via the avatar field; a bug in a front-end uploader that includes the full selected file path in the request body.

Related errors

• Bad Request
• Invalid avatar filename: ${avatar}
• Bad Request
• Invalid path
• Invalid background path: '${posixPath}'

AI-assisted analysis of SillyTavern/SillyTavern@8172dcd0ee (2026-08-13). Data as JSON: /api/errors/4c13d4a57e97e3ae. Report an issue: GitHub.