{"record":{"id":"5708bf4b6ec54833","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-data","errorCode":"error-invalid-data","errorMessage":"Invalid dataURI","messagePattern":"Invalid dataURI","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/users/setUserAvatar.ts","lineNumber":26,"sourceCode":"import type { ClientSession } from 'mongodb';\n\nimport { isRenderableImageType } from '../../../lib/renderableImageTypes';\nimport { onceTransactionCommitedSuccessfully } from '../../database/utils';\nimport { settings } from '../../settings';\nimport { hasPermissionAsync } from '../authorization/hasPermission';\nimport { SystemLogger } from '../logger/system';\nimport { RocketChatFile } from '../media/file';\nimport { FileUpload } from '../media/file-upload';\n\nexport const setAvatarFromServiceWithValidation = async (\n\tuserId: string,\n\tdataURI: string,\n\tcontentType?: string,\n\tservice?: string,\n\ttargetUserId?: string,\n): Promise<void> => {\n\tif (!dataURI) {\n\t\tthrow new Meteor.Error('error-invalid-data', 'Invalid dataURI', {\n\t\t\tmethod: 'setAvatarFromService',\n\t\t});\n\t}\n\n\tif (!userId) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\tmethod: 'setAvatarFromService',\n\t\t});\n\t}\n\n\tif (!settings.get('Accounts_AllowUserAvatarChange')) {\n\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed', {\n\t\t\tmethod: 'setAvatarFromService',\n\t\t});\n\t}\n\n\tlet user: IUser | null;\n","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/users/setUserAvatar.ts#L8-L44","documentation":"setAvatarFromServiceWithValidation requires a truthy dataURI as its second argument; an empty or undefined value throws error-invalid-data before any setting, permission, or user checks. The dataURI later carries a base64 data-URI string, an http(s) URL (service 'url'), or raw bytes (service 'rest'), but at this guard only emptiness is tested.","triggerScenarios":"setAvatarFromService(userId, '') from an upload form submitted without a file; API consumers mapping a missing request field to an empty avatar payload; client file read failing silently and sending an empty string.","commonSituations":"Avatar upload widget allows empty submit; REST body missing the avatar field; client-side FileReader errors swallowed before submit; test harnesses calling the method with no image.","solutions":["Require a non-empty avatar payload in the form/API layer before invoking the setter.","If the goal is resetting to the default avatar, use service 'initials' with the appropriate call rather than an empty payload.","Verify the client actually read the file successfully (check FileReader/fetch results) before submitting."],"exampleFix":"// before\nMeteor.call('setAvatarFromService', dataURI ?? '');\n\n// after\nif (!dataURI) {\n  throw new Error('Select an image first');\n}\nMeteor.call('setAvatarFromService', dataURI);","handlingStrategy":"validation","validationCode":"if (!dataURI || typeof dataURI !== 'string') {\n  throw new Meteor.Error('error-invalid-data', 'Invalid dataURI', { method: 'caller' });\n}\n// if it looks like a data URI, sanity-check the prefix\nif (dataURI.startsWith('data:') && !/^data:[\\w./+-]+;base64,/.test(dataURI)) {\n  throw new Meteor.Error('error-invalid-data', 'Malformed data URI');\n}\nawait setAvatarFromServiceWithValidation(userId, dataURI, contentType, service, targetUserId);","typeGuard":"const hasAvatarPayload = (v: unknown): v is string => typeof v === 'string' && v.length > 0;","tryCatchPattern":null,"preventionTips":["Disable the avatar save button until a file is actually selected and read.","Propagate FileReader/fetch errors on the client instead of swallowing them and submitting an empty string.","Use the 'initials' service to reset to the default avatar rather than sending empty data."],"tags":["avatar","validation","file-upload"],"backgroundTag":"missing-required-parameter","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}