{"record":{"id":"4f81df9e749e765d","repo":"ory/hydra","slug":"read-file-s","errorCode":null,"errorMessage":"read file: %s","messagePattern":"read file: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/fetcher/fetcher.go","lineNumber":130,"sourceCode":"\t}\n\treturn bytes.NewBuffer(b), nil\n}\n\n// FetchBytes fetches the file contents from the source and allows to pass a\n// context that is used for HTTP requests.\nfunc (f *Fetcher) FetchBytes(ctx context.Context, source string) ([]byte, error) {\n\tif !slices.ContainsFunc(f.schemes, func(scheme string) bool {\n\t\treturn strings.HasPrefix(source, scheme+\"://\")\n\t}) {\n\t\treturn nil, errors.WithStack(fmt.Errorf(\"%w: in source %q: allowed schemes: %s\", ErrUnknownScheme, redactedSource(source), strings.Join(f.schemes, \", \")))\n\t}\n\tswitch {\n\tcase strings.HasPrefix(source, \"http://\"), strings.HasPrefix(source, \"https://\"):\n\t\treturn f.fetchRemote(ctx, source)\n\tcase strings.HasPrefix(source, \"file://\"):\n\t\tb, err := os.ReadFile(strings.TrimPrefix(source, \"file://\"))\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"read file: %s\", redactedSource(source))\n\t\t}\n\t\treturn b, nil\n\tcase strings.HasPrefix(source, \"base64://\"):\n\t\tsrc, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(source, \"base64://\"))\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"base64decode: %s\", redactedSource(source))\n\t\t}\n\t\treturn src, nil\n\tdefault:\n\t\treturn nil, errors.Wrap(ErrUnknownScheme, \"unknown scheme in source: \"+redactedSource(source))\n\t}\n}\n\nfunc (f *Fetcher) fetchRemote(ctx context.Context, source string) (b []byte, err error) {\n\tif f.cache != nil {\n\t\tcacheKey := sha256.Sum256([]byte(source))\n\t\tif v, ok := f.cache.Get(cacheKey[:]); ok {\n\t\t\tb = make([]byte, len(v))","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/fetcher/fetcher.go#L112-L148","documentation":"FetchBytes dispatches on the source URI scheme. For file:// sources it calls os.ReadFile; any OS-level failure (missing file, permission denied, is-a-directory) is wrapped with 'read file: <redacted path>'.","triggerScenarios":"Calling FetchContext/FetchBytes with a file:// URL whose path does not exist, lacks read permission, points to a directory, or has a malformed path (e.g. file://relative/path or trailing whitespace).","commonSituations":"Config files referencing JWK/keys via file:// URLs that were moved or deleted; running in a container where the file was not mounted; permission differences between dev and prod environments.","solutions":["Verify the file exists at the exact path in the file:// URL (ls/stat it from the running environment).","Fix permissions so the process user can read the file, and ensure it is a regular file, not a directory.","In containers/k8s, mount the file into the container at the referenced path.","Use an absolute path: file:///etc/ory/jwks.json, not file://etc/ory/jwks.json."],"exampleFix":"// before\nfetcher.FetchContext(ctx, \"file://config/keys.json\") // relative, file not found\n// after\nfetcher.FetchContext(ctx, \"file:///etc/ory/config/keys.json\")","handlingStrategy":"validation","validationCode":"func validateFileSource(source string) error {\n\tif !strings.HasPrefix(source, \"file://\") {\n\t\treturn nil\n\t}\n\tpath := strings.TrimPrefix(source, \"file://\")\n\tif !filepath.IsAbs(path) {\n\t\treturn fmt.Errorf(\"file source must be absolute: %s\", source)\n\t}\n\tfi, err := os.Stat(path)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif fi.IsDir() {\n\t\treturn fmt.Errorf(\"file source is a directory: %s\", path)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"b, err := f.FetchContext(ctx, source)\nif err != nil && strings.HasPrefix(err.Error(), \"read file:\") {\n\tlog.Printf(\"config file unreadable, check existence/permissions: %v\", err)\n\tos.Exit(1)\n}","preventionTips":["Always use absolute paths in file:// URLs.","Check file existence and permissions at application startup, not lazily.","In containers, verify the file is mounted and readable by the process user."],"tags":["fetcher","filesystem","file-uri"],"backgroundTag":"file-not-found","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}