{"record":{"id":"66e930ebee979214","repo":"hyperledger/fabric","slug":"illegal-file-detected-in-payload-s","errorCode":null,"errorMessage":"illegal file detected in payload: \"%s\"","messagePattern":"illegal file detected in payload: \"(.+?)\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/platforms/java/platform.go","lineNumber":70,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"failure opening codepackage gzip stream: %s\", err)\n\t}\n\ttr := tar.NewReader(gr)\n\n\tfor {\n\t\theader, err := tr.Next()\n\t\tif err == io.EOF {\n\t\t\tbreak\n\t\t}\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check name for conforming path\n\t\t// --------------------------------------------------------------------------------------\n\t\tif !filesToMatch.MatchString(header.Name) || filesToIgnore.MatchString(header.Name) {\n\t\t\treturn fmt.Errorf(\"illegal file detected in payload: \\\"%s\\\"\", header.Name)\n\t\t}\n\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check that file mode makes sense\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Acceptable flags:\n\t\t//      ISREG      == 0100000\n\t\t//      -rw-rw-rw- == 0666\n\t\t//\n\t\t// Anything else is suspect in this context and will be rejected\n\t\t// --------------------------------------------------------------------------------------\n\t\tif header.Mode&^0o100666 != 0 {\n\t\t\treturn fmt.Errorf(\"illegal file mode detected for file %s: %o\", header.Name, header.Mode)\n\t\t}\n\t}\n\treturn nil\n}\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/platforms/java/platform.go#L52-L88","documentation":"While iterating the tar entries inside the chaincode package, every entry name must match the allowed regexp (^(/)?src/... or build.gradle/settings.gradle/pom.xml at the root) and must not be a .class file. Any entry violating these rules triggers this error naming the offending file.","triggerScenarios":"ValidateCodePackage encounters a tar header whose Name does not match the permitted paths (files outside src/, META-INF/, or the three root build files) or whose name ends in .class.","commonSituations":"Packaging a project with stray files at the tar root (README, IDE config, node_modules-like leftovers); including compiled .class files from a stale build directory; building the tar from the wrong directory so paths lack the src/ prefix.","solutions":["Repackage so all sources live under src/ (or META-INF/) plus root build.gradle/settings.gradle/pom.xml","Remove .class files from the package (clean the build output before packaging)","Rebuild the tar from the project root so entries are correctly prefixed","Inspect the package with `tar -tf mypackage.tgz` and remove disallowed entries"],"exampleFix":"// before\n// tar contains: README.md, src/contract.jar, target/App.class\n// after\n// tar contains only: src/contract.jar, src/META-INF/MANIFEST.MF, pom.xml","handlingStrategy":"validation","validationCode":"func precheckTarNames(tarPath string) error {\n    f, err := os.Open(tarPath); if err != nil { return err }\n    defer f.Close()\n    gr, err := gzip.NewReader(f); if err != nil { return err }\n    tr := tar.NewReader(gr)\n    re := regexp.MustCompile(`^(/)?src/((src|META-INF)/.*|(build\\.gradle|settings\\.gradle|pom\\.xml))`)\n    bad := regexp.MustCompile(`.*\\.class$`)\n    for {\n        h, err := tr.Next()\n        if err == io.EOF { return nil }\n        if err != nil { return err }\n        if !re.MatchString(h.Name) || bad.MatchString(h.Name) {\n            return fmt.Errorf(\"disallowed entry: %s\", h.Name)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := platform.ValidateCodePackage(code); err != nil {\n    var name string\n    if m := regexp.MustCompile(`illegal file detected in payload: \"(.*)\"`).FindStringSubmatch(err.Error()); m != nil {\n        name = m[1] // repack excluding this entry\n    }\n}","preventionTips":["Package only from the project root so entries carry the src/ prefix","Clean build outputs (.class files) before packaging","Inspect the tar listing (tar -tf) before install"],"tags":["chaincode","java","packaging","validation"],"backgroundTag":"illegal-file-in-package","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}