Zie619/n8n-workflows · warning · HTTPException

Invalid filename format

Error message

Invalid filename format

What it means

A 400 from GET /api/workflows/{filename} raised when validate_filename(filename) rejects the value. This is a deliberate security guard: filenames containing path segments, traversal sequences (../), or characters outside the allowed pattern are refused before any filesystem access. The same check is logged server-side as 'Security: Blocked path traversal attempt'.

Source

Thrown at api_server.py:315

                "trigger": trigger,
                "complexity": complexity,
                "active_only": active_only,
            },
        )
    except Exception as e:
        raise HTTPException(
            status_code=500, detail=f"Error searching workflows: {str(e)}"
        )


@app.get("/api/workflows/{filename}")
async def get_workflow_detail(filename: str, request: Request):
    """Get detailed workflow information including raw JSON."""
    try:
        # Security: Validate filename to prevent path traversal
        if not validate_filename(filename):
            print(f"Security: Blocked path traversal attempt for filename: {filename}")
            raise HTTPException(status_code=400, detail="Invalid filename format")

        # Security: Rate limiting
        client_ip = request.client.host if request.client else "unknown"
        if not check_rate_limit(client_ip):
            raise HTTPException(
                status_code=429, detail="Rate limit exceeded. Please try again later."
            )

        # Get workflow metadata from database
        workflows, _ = db.search_workflows(f'filename:"{filename}"', limit=1)
        if not workflows:
            raise HTTPException(
                status_code=404, detail="Workflow not found in database"
            )

        workflow_meta = workflows[0]

        # Load raw JSON from file with security checks

View on GitHub (pinned to 94007c1445)

Solutions

1. Send only the bare filename (e.g. 'my-workflow.json') exactly as returned by the /api/workflows listing's filename field.
2. Strip any directory component and URL-decode before issuing the request.
3. If a legitimately named file is rejected, inspect validate_filename() in api_server.py and either rename the file to match the allowed pattern or extend the regex deliberately.
4. Do not attempt to bypass the check; it exists to prevent path traversal.

Example fix

// before
const res = await fetch(`/api/workflows/${encodeURIComponent(fullPath)}`);

// after (bare filename only)
const res = await fetch(`/api/workflows/${encodeURIComponent(fileName)}`); // fileName = 'my-workflow.json'

const SAFE_FILENAME = /^[A-Za-z0-9][A-Za-z0-9._ -]*\.json$/;
function isValidFilename(name) {
  return typeof name === 'string' && SAFE_FILENAME.test(name) && !name.includes('..');
}

When it happens

Trigger: Requesting /api/workflows/../../etc/passwd, a filename with a slash ('subdir/file.json'), a leading dot, an empty or URL-encoded traversal payload (%2e%2e%2f), or any extension/pattern the validate_filename allowlist does not accept.

Common situations: Passing a full relative path from the UI instead of the bare filename; copy-pasting a URL-encoded filename whose decoded form contains forbidden characters; automated scanners probing the endpoint.

Related errors

• Access denied
• Invalid JSON in workflow file: {str(e)}
• Rate limit exceeded. Please try again later.
• Invalid authentication token
• str(e)

AI-assisted analysis of Zie619/n8n-workflows@94007c1445 (2026-08-15). Data as JSON: /api/errors/d749362d95fa1324. Report an issue: GitHub.