{"record":{"id":"3567e0a80c56b62e","repo":"parallax/jsPDF","slug":"trying-to-read-a-file-from-local-file-system-to-e","errorCode":null,"errorMessage":"Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property.","messagePattern":"Trying to read a file from local file system\\. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF\\.allowFsRead property\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/modules/fileloading.js","lineNumber":133,"sourceCode":"        return sanitizeUnicode(request.responseText);\n      }\n    };\n    try {\n      result = xhr(url, sync, callback);\n      // eslint-disable-next-line no-empty\n    } catch (e) {}\n    return result;\n  }\n\n  function nodeReadFile(url, sync, callback) {\n    sync = sync === false ? false : true;\n    var result = undefined;\n\n    var fs = require(\"fs\");\n    var path = require(\"path\");\n\n    if (!process.permission && !this.allowFsRead) {\n      throw new Error(\n        \"Trying to read a file from local file system. To enable this feature either run node with the --permission and --allow-fs-read flags or set the jsPDF.allowFsRead property.\"\n      );\n    }\n\n    try {\n      url = fs.realpathSync(path.resolve(url));\n    } catch (e) {\n      if (sync) {\n        return undefined;\n      } else {\n        callback(undefined);\n        return;\n      }\n    }\n\n    if (process.permission && !process.permission.has(\"fs.read\", url)) {\n      throw new Error(`Cannot read file '${url}'. Permission denied.`);\n    }","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/parallax/jsPDF/blob/a3930ce03a585a26b2c76d12a0f413ce96f6d1a3/src/modules/fileloading.js#L115-L151","documentation":"On the Node.js (CommonJS) build, loadFile delegates to nodeReadFile, which refuses to touch the filesystem unless EITHER Node's permission model is active (process.permission, enabled via `node --permission --allow-fs-read=...`) OR the jsPDF instance has allowFsRead set to an allowlist. With neither, reading a local file is blocked outright as a security default.","triggerScenarios":"Calling doc.loadFile('./path/to/font.ttf') or doc.loadImageFile(...) under Node.js without setting doc.allowFsRead and without running node with --permission --allow-fs-read. Triggered implicitly when addFont/addImage pull a file URL.","commonSituations":"Server-side PDF generation that bundles fonts/images from disk; CI that did not pass node permission flags; upgrading to a jsPDF version that introduced this guard and broke previously-working loadFile calls.","solutions":["Set an allowlist on the instance: doc.allowFsRead = ['./fonts/*', './assets/logo.png']; then call loadFile.","Run node with the permission model: node --permission --allow-fs-read=./fonts --allow-fs-read=./assets app.js (preferred for production).","Read the file yourself with fs.readFileSync and pass the buffer/string directly to addFont/addImage, bypassing loadFile entirely.","Load remote resources via URL (browser XHR path) instead of local file paths."],"exampleFix":"// before\nconst ttf = doc.loadFile('./fonts/Roboto.ttf', true); // throws [113]\n\n// after\nconst doc = new jsPDF();\ndoc.allowFsRead = ['./fonts/*'];\nconst ttf = doc.loadFile('./fonts/Roboto.ttf', true);","handlingStrategy":"validation","validationCode":"// Pre-flight: ensure filesystem reads are enabled before calling loadFile.\nfunction ensureFsReadable(doc, paths) {\n  if (typeof process === 'undefined' || !process.versions?.node) return; // browser path\n  if (!process.permission && !doc.allowFsRead) {\n    doc.allowFsRead = paths; // e.g. ['./fonts/*', './assets/*']\n  }\n}\n// usage:\nensureFsReadable(doc, ['./fonts/*']);\ndoc.loadFile('./fonts/Roboto.ttf', true);","typeGuard":"function fsReadEnabled(doc) {\n  return (typeof process !== 'undefined' && !!process.permission) || Array.isArray(doc.allowFsRead);\n}","tryCatchPattern":"try {\n  const data = doc.loadFile(path, true);\n} catch (e) {\n  if (/Trying to read a file from local file system/.test(e.message)) {\n    doc.allowFsRead = [require('path').dirname(path) + '/*'];\n    // retry once, or read manually with fs and pass the buffer\n  } else throw e;\n}","preventionTips":["Configure doc.allowFsRead once at startup with all needed prefixes.","For production, prefer node --permission --allow-fs-read over the property.","Read files yourself with fs and hand buffers to addFont/addImage to bypass loadFile."],"tags":["node","security","fileloading","permissions","filesystem","config"],"backgroundTag":null,"analyzedSha":"a3930ce03a585a26b2c76d12a0f413ce96f6d1a3","analyzedAt":"2026-08-13T05:33:39.648Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}