{"record":{"id":"7f72b34d8296cb1a","repo":"FlowiseAI/Flowise","slug":"invalid-filename-filename-is-required-and-must-be","errorCode":null,"errorMessage":"Invalid filename: filename is required and must be a string","messagePattern":"Invalid filename: filename is required and must be a string","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":103,"sourceCode":"        // eslint-disable-next-line no-control-regex\n        /[\\x00-\\x1f]/, // Control characters\n        /^\\/[^/]/, // Absolute Unix paths (starting with /)\n        /^[a-zA-Z]:\\\\/, // Absolute Windows paths (C:\\)\n        /^\\\\\\\\[^\\\\]/, // UNC paths (\\\\server\\)\n        /^\\\\\\\\\\?\\\\/ // Extended-length paths (\\\\?\\)\n    ]\n\n    return dangerousPatterns.some((pattern) => pattern.test(filePath))\n}\n\n/**\n * Validates filename format and security\n * @param {string} filename The filename to validate\n * @returns {void} Throws an error if validation fails\n */\nconst validateFilename = (filename: string): void => {\n    if (!filename || typeof filename !== 'string') {\n        throw new Error('Invalid filename: filename is required and must be a string')\n    }\n    if (isUnsafeFilePath(filename)) {\n        throw new Error(`Invalid filename: unsafe characters or path traversal attempt detected in filename \"${filename}\"`)\n    }\n}\n\n/**\n * Extracts and normalizes file extension from filename\n * @param {string} filename The filename\n * @returns {string} The normalized extension (lowercase, without dot) or empty string\n */\nconst extractFileExtension = (filename: string): string => {\n    const filenameParts = filename.split('.')\n    if (filenameParts.length <= 1) {\n        return ''\n    }\n    let ext = filenameParts.pop()!.toLowerCase()\n    // Normalize common extension variations to match MIME type mappings","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L85-L121","documentation":"Thrown by validateFilename when the filename argument is falsy (null, undefined, '', 0) or not a string type. validateFilename is the entry guard for validateMimeTypeAndExtensionMatch, so this fires before any MIME/extension logic. It is a type/contract violation from the caller, not a security finding.","triggerScenarios":"Multer/formidable provided req.file as undefined because no file was uploaded but the handler still called validate; a caller passed file.originalname which is undefined for a malformed multipart part; programmatic caller passed null filename by mistake.","commonSituations":"File upload handler invoked validation unconditionally even when the field is optional; client sent a multipart part without a filename; refactor changed the shape of the upload object (filename moved from .name to .originalname) and the caller wasn't updated.","solutions":["Check that req.file / the upload object exists and has a string filename before calling validateMimeTypeAndExtensionMatch.","Return a 400 'no file provided' from the handler when the file is missing rather than letting validation throw.","Type the caller so filename is enforced as string at compile time."],"exampleFix":"// before\nvalidateFilename(filename)\n\n// after — guard at the handler boundary\nif (!req.file || typeof req.file.originalname !== 'string') {\n  return res.status(400).json({ error: 'A file with a valid filename is required' })\n}\nvalidateMimeTypeAndExtensionMatch(req.file.originalname, req.file.mimetype)","handlingStrategy":"type-guard","validationCode":"function isNonEmptyString(v: unknown): v is string {\n  return typeof v === 'string' && v.trim().length > 0\n}","typeGuard":"function isValidFilename(v: unknown): v is string {\n  return typeof v === 'string' && v.length > 0\n}","tryCatchPattern":"if (!isValidFilename(filename)) {\n  throw new Error('Invalid filename: filename is required and must be a string')\n}","preventionTips":["Type upload handlers so filename is enforced as string at compile time.","Return a 400 'no file' from handlers when req.file is missing instead of calling validate.","Unit-test the validator with undefined/null/number inputs."],"tags":["validation","file-upload","type-guard","security"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}