{"record":{"id":"35528b1207878384","repo":"Mintplex-Labs/anything-llm","slug":"failed-to-create-folder-e-message-35528b","errorCode":null,"errorMessage":"Failed to create folder: ${e.message} ","messagePattern":"Failed to create folder: (.+?) ","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"server/endpoints/document.js","lineNumber":36,"sourceCode":"      try {\n        const { name } = reqBody(request);\n        const storagePath = path.join(documentsPath, normalizePath(name));\n        if (!isWithin(path.resolve(documentsPath), path.resolve(storagePath)))\n          throw new Error(\"Invalid folder name.\");\n\n        if (fs.existsSync(storagePath)) {\n          response.status(500).json({\n            success: false,\n            message: \"Folder by that name already exists\",\n          });\n          return;\n        }\n\n        fs.mkdirSync(storagePath, { recursive: true });\n        response.status(200).json({ success: true, message: null });\n      } catch (e) {\n        console.error(e);\n        response.status(500).json({\n          success: false,\n          message: `Failed to create folder: ${e.message} `,\n        });\n      }\n    }\n  );\n\n  app.post(\n    \"/document/move-files\",\n    [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],\n    async (request, response) => {\n      try {\n        const { files } = reqBody(request);\n        const docpaths = files.map(({ from }) => from);\n        const documents = await Document.where({ docpath: { in: docpaths } });\n\n        const embeddedFiles = documents.map((doc) => doc.docpath);\n        const moveableFiles = files.filter(","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/3aec848f2885144aa8f1e53b9731a04310d5d558/server/endpoints/document.js#L18-L54","documentation":"Catch-all 500 for POST /document/create-folder wrapping everything outside the duplicate check: the explicit throw new Error('Invalid folder name.') when normalizePath(name) escapes documentsPath (isWithin guard), and any fs.mkdirSync failure (EACCES, EROFS, ENOSPC, illegal characters on the host OS). The underlying e.message is appended after the prefix.","triggerScenarios":"name containing '../' segments or an absolute path that fails the isWithin(documentsPath) guard; mkdirSync hitting EACCES/EROFS because the documents folder is not writable; a name with characters illegal on the filesystem (e.g. ':' on Windows); disk full (ENOSPC).","commonSituations":"API consumers passing unsanitized names with traversal sequences; documents folder owned by another user after a container migration; read-only Docker volume mount for document storage.","solutions":["Read the suffix after 'Failed to create folder:' — it names the real cause ('Invalid folder name.', EACCES, ENOSPC...)","If 'Invalid folder name.', strip '../' and absolute-path segments from name and retry","If EACCES/EROFS, fix ownership/permissions of documentsPath or remount the volume read-write","If ENOSPC, free disk space on the storage volume"],"exampleFix":"// before\nconst name = rawName; // may contain '../'\n// after\nconst safeName = rawName.replace(/\\.\\.+/g, '.').replace(/^\\/+/, '').trim();\nif (!safeName || safeName.includes('/')) throw new Error('Invalid folder name.');","handlingStrategy":"validation","validationCode":"// Sanitize before sending\nconst safeName = name.replace(/\\.\\.+/g, '.').replace(/^\\/+/, '').trim();\nif (!safeName || safeName.includes('/') || safeName.includes('\\\\')) throw new Error('Invalid folder name');","typeGuard":"function isSafeFolderName(name) {\n  return typeof name === 'string' && name.trim().length > 0\n    && !name.includes('..') && !path.isAbsolute(name);\n}","tryCatchPattern":"try { await createFolder(name); } catch (e) {\n  const cause = e.message.replace(/^Failed to create folder:\\s*/, '');\n  if (cause === 'Invalid folder name.') highlightNameInput();\n  else if (/EACCES|EROFS/.test(cause)) alertAdmin('documents folder not writable');\n}","preventionTips":["Strip traversal segments and absolute paths from user-supplied names client-side","Ensure the process owns or can write documentsPath (check on deploy)","Branch on the embedded e.message suffix — it names the real errno"],"tags":["documents","filesystem","path-traversal","permissions"],"backgroundTag":"directory-create-failed","analyzedSha":"3aec848f2885144aa8f1e53b9731a04310d5d558","analyzedAt":"2026-08-18T10:02:21.017Z","contentChangedAt":"2026-08-18T10:02:21.017Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}