{"record":{"id":"2519298afbf2a1c3","repo":"puppetlabs/puppet","slug":"listing-remote-file-buckets-is-not-allowed-251929","errorCode":null,"errorMessage":"Listing remote file buckets is not allowed","messagePattern":"Listing remote file buckets is not allowed","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/indirector/file_bucket_file/file.rb","lineNumber":47,"sourceCode":"        if request.options[:diff_with]\n          other_contents_file = path_for(request.options[:bucket_path], request.options[:diff_with], 'contents')\n          raise _(\"could not find diff_with %{diff}\") % { diff: request.options[:diff_with] } unless Puppet::FileSystem.exist?(other_contents_file)\n          raise _(\"Unable to diff on this platform\") unless Puppet[:diff] != \"\"\n\n          diff(Puppet::FileSystem.path_string(contents_file), Puppet::FileSystem.path_string(other_contents_file))\n        else\n          # TRANSLATORS \"FileBucket\" should not be translated\n          Puppet.info _(\"FileBucket read %{checksum}\") % { checksum: checksum }\n          model.new(Puppet::FileSystem.binread(contents_file))\n        end\n      else\n        nil\n      end\n    end\n\n    def list(request)\n      if request.remote?\n        raise Puppet::Error, _(\"Listing remote file buckets is not allowed\")\n      end\n\n      fromdate = request.options[:fromdate] || \"0:0:0 1-1-1970\"\n      todate = request.options[:todate] || Time.now.strftime(\"%F %T\")\n      begin\n        to = Time.parse(todate)\n      rescue ArgumentError\n        raise Puppet::Error, _(\"Error while parsing 'todate'\")\n      end\n      begin\n        from = Time.parse(fromdate)\n      rescue ArgumentError\n        raise Puppet::Error, _(\"Error while parsing 'fromdate'\")\n      end\n      # Setting hash's default value to [], needed by the following loop\n      bucket = Hash.new { [] }\n      msg = ''.dup\n      # Get all files with mtime between 'from' and 'to'","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/indirector/file_bucket_file/file.rb#L29-L65","documentation":"The FileBucket 'file' terminus implements list (the search action) by walking the local bucket directory and matching file mtimes against a fromdate/todate window. The method refuses any request whose node or ip attribute is set (request.remote? is true), because bucket enumeration is only supported by the process that owns the bucket files. There is no server-side setting that enables remote listing, so the raise is unconditional.","triggerScenarios":"Running 'puppet filebucket list --fromdate ... --todate ...' with the -r/--remote flag, or issuing a REST search against the file_bucket_file indirection (GET /puppet/v3/file_bucket_file/... with search semantics) from a host other than the one holding bucketdir. Any such request carries node/ip, so remote? is true and list raises Puppet::Error before date parsing even starts.","commonSituations":"An admin tries to audit or prune the Puppet server's file bucket from a workstation and adds --remote because filebucket find and backup accept it. CI or cleanup scripts try to enumerate bucket contents over HTTPS. Users copy 'puppet filebucket find <sum> --remote' habits into the list subcommand.","solutions":["SSH into the host that owns bucketdir (usually the Puppet server) and run 'puppet filebucket list --fromdate ... --todate ...' there without --remote.","For specific known files use 'puppet filebucket find <checksum> --remote', which is permitted remotely.","Enumerate the bucket directly: find \"$(puppet config print bucketdir)\" -name paths -newermt 'YYYY-MM-DD'.","Wrap the local command in SSH for scheduled remote audits; do not try to re-enable remote listing."],"exampleFix":"# before (from a workstation)\npuppet filebucket list --remote --fromdate \"2024-01-01\"\n# Error: Listing remote file buckets is not allowed\n\n# after (on the bucket host)\nssh puppet.example.com 'puppet filebucket list --fromdate \"2024-01-01\"'","handlingStrategy":"validation","validationCode":"# refuse to attempt a remote listing up front\ntarget = Puppet.settings[:server]\nlocal = [target, target.split('.').first].include?(Socket.gethostname)\nraise ArgumentError, 'filebucket list must run on the bucket host' unless local\nPuppet::FileBucket::File.indirection.search(key, bucket_path: Puppet.settings[:bucketdir])","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat filebucket list as a local-only maintenance command; budget an SSH hop for it.","Remember only find and backup accept --remote.","Automate bucket audits with cron on the server itself instead of remote enumeration."],"tags":["puppet","filebucket","indirector","rest","server-side-check"],"backgroundTag":"remote-operation-not-permitted","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}