{"record":{"id":"054597d2ff0c36dc","repo":"RocketChat/Rocket.Chat","slug":"invalid-asset","errorCode":null,"errorMessage":"Invalid asset","messagePattern":"Invalid asset","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/api/v1/assets.ts","lineNumber":53,"sourceCode":"\t},\n\tasync function action() {\n\t\tconst asset = await getUploadFormData(\n\t\t\t{\n\t\t\t\trequest: this.request,\n\t\t\t},\n\t\t\t{ field: 'asset', sizeLimit: settings.get('FileUpload_MaxFileSize') },\n\t\t);\n\n\t\tconst { fileBuffer, fields, filename, mimetype } = asset;\n\n\t\tconst { refreshAllClients, assetName: customName } = fields;\n\n\t\tconst assetName = customName || filename;\n\t\tconst assetsKeys = Object.keys(RocketChatAssets.assets);\n\n\t\tconst isValidAsset = assetsKeys.includes(assetName);\n\t\tif (!isValidAsset) {\n\t\t\tthrow new Error('Invalid asset');\n\t\t}\n\n\t\tconst { key, value } = await RocketChatAssets.setAssetWithBuffer(fileBuffer, mimetype, assetName);\n\n\t\tconst { modifiedCount } = await updateAuditedByUser({\n\t\t\t_id: this.userId,\n\t\t\tusername: this.user.username ?? '',\n\t\t\tip: this.requestIp ?? '',\n\t\t\tuseragent: this.request.headers.get('user-agent') ?? '',\n\t\t})(Settings.updateValueById, key, value);\n\n\t\tif (modifiedCount) {\n\t\t\tvoid notifyOnSettingChangedById(key);\n\t\t}\n\n\t\tif (refreshAllClients) {\n\t\t\tawait refreshClients(this.userId);\n\t\t}","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/api/v1/assets.ts#L35-L71","documentation":"Thrown by POST assets.setAsset when the uploaded file's resolved asset name (the refreshAllClients form field 'asset', falling back to the upload filename) is not one of the keys registered in RocketChatAssets.assets. The endpoint only accepts a fixed whitelist of theme asset names (logo, favicon, tile, etc.), so any other filename is rejected before storage.","triggerScenarios":"POST /api/v1/assets.setAsset (multipart) where the 'asset' form field or the file's filename is e.g. 'my-company-logo.png' instead of a registered name like 'logo' or 'logo_1024.png', or a typo such as 'favion'.","commonSituations":"Automation scripts upload with the original design file name; CI renames assets before upload; admin uploads a new custom asset type not in the whitelist; trailing spaces or case differences in the asset name.","solutions":["Send the canonical asset key in the 'asset' multipart field (e.g. 'logo', 'favicon') rather than relying on the filename","List valid keys first: they are the keys of the assets registry (client-side asset manager or server settings) before uploading","Match the exact casing and suffix conventions (e.g. logo_1024 for variants)","Retry the upload with content-type multipart/form-data and the file under the 'asset' file field per the API docs"],"exampleFix":"// before (curl -F file=@My_Logo_Design_Final.png)\n// after\ncurl -F \"file=@logo.png;filename=logo\" -F asset=logo ... /api/v1/assets.setAsset","handlingStrategy":"validation","validationCode":"const VALID_ASSETS = ['logo', 'logo_1024', 'favicon', 'tile', 'tile_144', 'tile_180', 'tile_192'];\nconst assetName = form.get('asset') || file.name;\nif (!VALID_ASSETS.includes(assetName)) throw new Error(`Unknown asset: ${assetName}`);","typeGuard":"const isValidAssetName = (name: string): boolean =>\n  Object.keys(ASSET_REGISTRY).includes(name);","tryCatchPattern":"try { await POST('/api/v1/assets.setAsset', form); } catch (e) {\n  if (e.message === 'Invalid asset') { /* show allowed asset names */ }\n}","preventionTips":["Send the canonical asset key in the 'asset' form field","Derive the allowed list from the asset registry instead of hardcoding filenames","Keep upload scripts in sync when new asset types are added in upgrades"],"tags":["assets","rest-api","multipart-upload","validation","rocket-chat"],"backgroundTag":"invalid-asset-name","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}