{"record":{"id":"6404a786d6316e5a","repo":"gotify/server","slug":"invalid-file","errorCode":null,"errorMessage":"invalid file","messagePattern":"invalid file","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"router/router.go","lineNumber":321,"sourceCode":"\t\t\tStr(\"method\", c.Request.Method).\n\t\t\tStr(\"path\", path)\n\n\t\tif errs := c.Errors.ByType(gin.ErrorTypePrivate).String(); errs != \"\" {\n\t\t\tevt.Str(\"errors\", strings.TrimSpace(errs))\n\t\t}\n\n\t\tevt.Msg(\"HTTP\")\n\t}\n}\n\ntype onlyImageFS struct {\n\tinner http.FileSystem\n}\n\nfunc (fs *onlyImageFS) Open(name string) (http.File, error) {\n\text := filepath.Ext(name)\n\tif !api.ValidApplicationImageExt(ext) {\n\t\treturn nil, fmt.Errorf(\"invalid file\")\n\t}\n\treturn fs.inner.Open(name)\n}\n","sourceCodeStart":303,"sourceCodeEnd":325,"githubUrl":"https://github.com/gotify/server/blob/14bfc256276775c425f988d621dccfe705de18ac/router/router.go#L303-L325","documentation":"onlyImageFS wraps the static file system serving application images and rejects any request whose file extension is not a valid application image extension, returning 'invalid file' to block serving of non-image or path-manipulated files.","triggerScenarios":"An HTTP request to the image route for a filename with an extension not in the allowed image set (e.g. .php, .html, .txt, or no extension).","commonSituations":"Probing for path traversal or sensitive files (../../etc/passwd), or clients referencing an uploaded image by the wrong filename/extension.","solutions":["Request only files with valid image extensions (check api.ValidApplicationImageExt for the allowed set)","Use the correct filename returned by the image upload API","Do not attempt to serve arbitrary files through the image endpoint"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"name := \"photo.png\"\nif !api.ValidApplicationImageExt(filepath.Ext(name)) {\n    log.Printf(\"%s is not a valid image name\", name)\n}","typeGuard":"func validImageName(name string) bool {\n    return api.ValidApplicationImageExt(filepath.Ext(name))\n}","tryCatchPattern":"resp, err := http.Get(imageURL)\nif err != nil || resp.StatusCode != http.StatusOK {\n    body, _ := io.ReadAll(resp.Body)\n    if strings.Contains(string(body), \"invalid file\") {\n        log.Printf(\"bad image path %s\", imageURL)\n    }\n}","preventionTips":["Use filenames/URLs exactly as returned by the upload API","Never hand-craft paths on the image endpoint","Sanitize extensions client-side before requesting images"],"tags":["http","security","file-serving"],"backgroundTag":"invalid-file-extension","analyzedSha":"14bfc256276775c425f988d621dccfe705de18ac","analyzedAt":"2026-09-05T12:52:36.781Z","contentChangedAt":"2026-09-05T12:52:36.781Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}