{"record":{"id":"33476f72369194b5","repo":"hyperledger/fabric","slug":"illegal-file-detected-in-payload-s-33476f","errorCode":null,"errorMessage":"illegal file detected in payload: \"%s\"","messagePattern":"illegal file detected in payload: \"(.+?)\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/platforms/node/platform.go","lineNumber":101,"sourceCode":"\tgr, err := gzip.NewReader(is)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failure opening codepackage gzip stream: %s\", err)\n\t}\n\ttr := tar.NewReader(gr)\n\n\tfoundPackageJson := false\n\tfor {\n\t\theader, err := tr.Next()\n\t\tif err != nil {\n\t\t\t// We only get here if there are no more entries to scan\n\t\t\tbreak\n\t\t}\n\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check name for conforming path\n\t\t// --------------------------------------------------------------------------------------\n\t\tif !re.MatchString(header.Name) {\n\t\t\treturn fmt.Errorf(\"illegal file detected in payload: \\\"%s\\\"\", header.Name)\n\t\t}\n\t\tif header.Name == \"src/package.json\" {\n\t\t\tfoundPackageJson = true\n\t\t}\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check that file mode makes sense\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Acceptable flags:\n\t\t//      ISREG      == 0100000\n\t\t//      -rw-rw-rw- == 0666\n\t\t//\n\t\t// Anything else is suspect in this context and will be rejected\n\t\t// --------------------------------------------------------------------------------------\n\t\tif header.Mode&^0o100666 != 0 {\n\t\t\treturn fmt.Errorf(\"illegal file mode detected for file %s: %o\", header.Name, header.Mode)\n\t\t}\n\t}\n\tif !foundPackageJson {","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/platforms/node/platform.go#L83-L119","documentation":"This error is thrown by ValidateCodePackage in the Node.js chaincode platform when a tar entry name inside the deployment payload fails the conforming-path regex. The platform scans every header of the packaged .tar.gz and rejects any file whose path does not match the allowed pattern, since arbitrary or absolute paths could escape the src/ layout (path traversal).","triggerScenarios":"Calling ValidateCodePackage with a code package whose tar archive contains a header.Name that does not match the platform's conforming-path regular expression — e.g. entries with '..' segments, absolute paths, or unexpected prefixes like 'package.json' instead of 'src/package.json'.","commonSituations":"Hand-crafted chaincode packages built with a different directory layout, packages generated by tools that store absolute paths, packages with symlinks or parent-directory entries, or corrupted/edited .tar.gz payloads.","solutions":["Rebuild the chaincode package so every tar entry uses a relative path under src/ (package.json must be exactly 'src/package.json').","Verify no tar entry contains '..' segments or absolute paths (tar -tf package.tar.gz to inspect).","Use the platform's own GetDeploymentPayload (the packaging API) instead of manually creating the tarball.","Unpack the archive, normalize file names, and re-tar with relative paths (e.g. tar -czf pkg.tar.gz -C <root> .)."],"exampleFix":"// before: tar created with absolute paths\ntar -czf chaincode.tar.gz /home/user/chaincode/src\n// after: relative paths under src/\ntar -czf chaincode.tar.gz -C /home/user/chaincode src","handlingStrategy":"validation","validationCode":"const okEntry = (name) => !name.includes('..') && !path.isAbsolute(name) && name.startsWith('src/');\n// verify every tar entry before submitting:\n// entries.every(e => okEntry(e.name))","typeGuard":"function isConformingEntry(name) {\n  return typeof name === 'string' && name.startsWith('src/') && !name.includes('..') && !path.isAbsolute(name);\n}","tryCatchPattern":null,"preventionTips":["Package chaincode with Fabric's own packaging commands rather than hand-rolled tar files","Always use relative paths rooted at src/ in the archive","Inspect archives with tar -tf before deployment","Never include symlinks or '..' segments in chaincode packages"],"tags":["chaincode","packaging","validation","path-traversal"],"backgroundTag":"illegal-file-in-payload","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}