{"record":{"id":"8e086331aa62ae9a","repo":"danny-avila/LibreChat","slug":"invalid-file-path-filepath","errorCode":null,"errorMessage":"Invalid file path: ${filepath}","messagePattern":"Invalid file path: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/server/services/Files/Local/crud.js","lineNumber":335,"sourceCode":"  return { filepath, bytes, height, width };\n}\n\n/**\n * Retrieves a readable stream for a file from local storage.\n *\n * @param {ServerRequest} req - The request object from Express\n * @param {string} filepath - The filepath.\n * @returns {ReadableStream} A readable stream of the file.\n */\nasync function getLocalFileStream(req, filepath) {\n  try {\n    const appConfig = req.config;\n    if (filepath.includes('/uploads/')) {\n      const basePath = filepath.split('/uploads/')[1];\n\n      if (!basePath) {\n        logger.warn(`Invalid base path: ${filepath}`);\n        throw new Error(`Invalid file path: ${filepath}`);\n      }\n\n      const fullPath = path.join(appConfig.paths.uploads, basePath);\n      const uploadsDir = appConfig.paths.uploads;\n\n      const rel = path.relative(uploadsDir, fullPath);\n      if (rel.startsWith('..') || path.isAbsolute(rel) || rel.includes(`..${path.sep}`)) {\n        logger.warn(`Invalid relative file path: ${filepath}`);\n        throw new Error(`Invalid file path: ${filepath}`);\n      }\n\n      return fs.createReadStream(fullPath);\n    } else if (filepath.includes('/images/')) {\n      const basePath = filepath.split('/images/')[1];\n\n      if (!basePath) {\n        logger.warn(`Invalid base path: ${filepath}`);\n        throw new Error(`Invalid file path: ${filepath}`);","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/danny-avila/LibreChat/blob/5ff282f9006c436e561de1afd39a481bea1ef0d8/api/server/services/Files/Local/crud.js#L317-L353","documentation":"Thrown by getLocalFileStream when the filepath includes '/uploads/' but the portion after it is empty — meaning the filepath is exactly '/uploads/' or ends with '/uploads/'. The split produces an empty basePath, indicating no actual file was specified within the uploads directory.","triggerScenarios":"Calling getLocalFileStream(req, filepath) where filepath is '/uploads/' or '/some/prefix/uploads/' with nothing following the final '/uploads/' segment. The basePath extracted via split('/uploads/')[1] is undefined or empty.","commonSituations":"A caller constructs a filepath by concatenating '/uploads/' with a missing or empty filename. Or a database record stores a bare '/uploads/' path. Or a URL routing bug passes the uploads prefix without the user-specific subpath.","solutions":["Verify the filepath passed to getLocalFileStream is a complete path like /uploads/{userId}/{file_id}__{filename}.","Validate filepath format before calling getLocalFileStream: it must contain a non-empty segment after /uploads/.","Audit the caller to ensure filepath is sourced from a validated database record, not from client input.","Return a 400 Bad Request at the route level if the filepath is incomplete."],"exampleFix":"// before\nconst stream = await getLocalFileStream(req, filepath);\n\n// after — validate before calling\nif (!filepath || filepath.endsWith('/uploads/') || filepath.endsWith('/images/')) {\n  throw new Error('Incomplete file path: missing filename');\n}\nconst stream = await getLocalFileStream(req, filepath);","handlingStrategy":"validation","validationCode":"if (filepath.includes('/uploads/')) {\n  const basePath = filepath.split('/uploads/')[1];\n  if (!basePath) {\n    throw new Error('Incomplete uploads path: missing filename');\n  }\n}","typeGuard":"function hasUploadFilename(filepath: string): boolean {\n  if (!filepath.includes('/uploads/')) return true;\n  const basePath = filepath.split('/uploads/')[1];\n  return basePath != null && basePath.length > 0;\n}","tryCatchPattern":"try {\n  const stream = await getLocalFileStream(req, filepath);\n} catch (error) {\n  if (error.message.startsWith('Invalid file path')) {\n    return res.status(400).json({ error: 'Incomplete file path' });\n  }\n  throw error;\n}","preventionTips":["Validate filepath completeness before calling getLocalFileStream.","Ensure filepath always includes the full subpath (userId + filename) after /uploads/.","Source filepath from validated database records, not from client URL parameters."],"tags":["file-stream","local-storage","input-validation","data-integrity"],"backgroundTag":null,"analyzedSha":"5ff282f9006c436e561de1afd39a481bea1ef0d8","analyzedAt":"2026-08-12T21:38:08.145Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}