{"record":{"id":"48d89971ea750252","repo":"apache/shenyu","slug":"file-file-cannot-be-read","errorCode":null,"errorMessage":"File '\" + file + \"' cannot be read","messagePattern":"File '\" \\+ file \\+ \"' cannot be read","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/HttpUtils.java","lineNumber":741,"sourceCode":"                output.write(buffer, 0, n);\n            }\n            return output.toByteArray();\n        }\n\n        /**\n         * file to bytes.\n         *\n         * @param file file\n         * @return byte\n         * @throws IOException IOException\n         */\n        public static byte[] toBytes(final File file) throws IOException {\n            if (file.exists()) {\n                if (file.isDirectory()) {\n                    throw new IOException(\"File '\" + file + \"' exists but is a directory\");\n                }\n                if (!file.canRead()) {\n                    throw new IOException(\"File '\" + file + \"' cannot be read\");\n                }\n            } else {\n                throw new FileNotFoundException(\"File '\" + file + \"' does not exist\");\n            }\n            InputStream input = null;\n            try {\n                input = Files.newInputStream(file.toPath());\n                return toBytes(input);\n            } finally {\n                try {\n                    if (Objects.nonNull(input)) {\n                        input.close();\n                    }\n                } catch (IOException ioe) {\n                    LOG.error(\"toBytes error\", ioe);\n                }\n            }\n        }","sourceCodeStart":723,"sourceCodeEnd":759,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/HttpUtils.java#L723-L759","documentation":"HttpUtils.toBytes(File) requires read permission on the file before opening it. When File.canRead() reports false it throws IOException \"File '...' cannot be read\", failing before an InputStream is opened.","triggerScenarios":"Calling toBytes on an existing, non-directory file that the JVM process has no read permission for (OS-level ACLs, ownership by another user, or restrictive umask).","commonSituations":"shenyu-admin running as a non-root service account while the certificate/key/upload file was installed as root with 0600 permissions; files mounted read-only or with wrong ownership in containers.","solutions":["Fix file permissions: chmod/chown so the admin process user has read access (e.g. chmod 644 for public certs, chown to the service user for keys).","Verify which OS user the shenyu-admin process runs as (ps aux) and grant that user read access.","In Docker, ensure the file is COPYed/owned correctly in the image rather than mounted with root-only permissions.","Pre-check with Files.isReadable(path) and fail with an actionable message."],"exampleFix":"// before (shell)\n-rw------- root root /etc/shenyu/certs/server.pem\n// after (shell)\nchown shenyu:shenyu /etc/shenyu/certs/server.pem && chmod 400 /etc/shenyu/certs/server.pem","handlingStrategy":"validation","validationCode":"Path path = file.toPath();\nif (!Files.exists(path)) throw new FileNotFoundException(\"Missing file: \" + path);\nif (!Files.isReadable(path)) throw new AccessDeniedException(\"Not readable by current user: \" + path);","typeGuard":null,"tryCatchPattern":"try {\n    byte[] bytes = HttpUtils.toBytes(file);\n} catch (IOException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"cannot be read\")) {\n        throw new IllegalStateException(\"Grant read permission to the shenyu-admin process user for: \" + file, e);\n    }\n    throw e;\n}","preventionTips":["Run the admin process under a user that owns (or can read) certificate/key files.","Set explicit permissions in Dockerfile (COPY --chown) rather than relying on host ownership.","Check canRead()/Files.isReadable() at config-load time, before first use.","Document required permissions for mounted secrets in your deployment guide."],"tags":["io","file","permissions"],"backgroundTag":"file-read-failed","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}