{"record":{"id":"95b6264fd38cbfbb","repo":"langflow-ai/langflow","slug":"invalid-file-path-format","errorCode":null,"errorMessage":"Invalid file path format","messagePattern":"Invalid file path format","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"src/backend/base/langflow/api/utils/flow_utils.py","lineNumber":166,"sourceCode":"def validate_public_files(files: list[str] | None, source_flow_id: uuid.UUID) -> None:\n    \"\"\"Reject file references that aren't ``{source_flow_id}/{basename}``.\n\n    Mitigates GHSA-rcjh-r59h-gq37: an unauthenticated build must not be\n    able to address files outside its own flow's storage namespace.\n    Called from any endpoint that accepts caller-supplied file references\n    under a public-access boundary.\n    \"\"\"\n    if not files:\n        return\n    expected_flow_id = str(source_flow_id).lower()\n    for entry in files:\n        if not isinstance(entry, str) or not entry:\n            raise HTTPException(status_code=400, detail=\"Invalid file entry\")\n        if any(token in entry for token in _PUBLIC_FILE_REJECTED_SUBSTRINGS):\n            raise HTTPException(status_code=400, detail=\"Invalid file path\")\n        match = _PUBLIC_FILE_PATH_RE.match(entry)\n        if not match:\n            raise HTTPException(status_code=400, detail=\"Invalid file path format\")\n        flow_id_segment, basename = match.group(1), match.group(2)\n        if flow_id_segment.lower() != expected_flow_id:\n            raise HTTPException(status_code=400, detail=\"File not in this flow's namespace\")\n        if basename in (\".\", \"..\"):\n            raise HTTPException(status_code=400, detail=\"Invalid filename\")\n\n\ndef compute_virtual_flow_id(\n    identifier: str | uuid.UUID,\n    flow_id: uuid.UUID,\n    *,\n    principal_type: Literal[\"user\", \"client\"] | None = None,\n) -> uuid.UUID:\n    \"\"\"Compute a deterministic virtual flow ID for session/message isolation.\n\n    Args:\n        identifier: A unique identifier (user_id for authenticated users, client_id for anonymous).\n        flow_id: The original flow ID.","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/utils/flow_utils.py#L148-L184","documentation":"HTTP 400 from validate_public_files when an entry does not match _PUBLIC_FILE_PATH_RE: ^({uuid})/([^/\\\\]+)$. The reference must be exactly a flow UUID, a single slash, and a basename containing no further separators — no absolute paths, no query strings, no subdirectories, no filenames with slashes.","triggerScenarios":"Sending 'data.csv' (missing flow prefix), '/abs/path/data.csv', '{uuid}/sub/dir/file.csv' (nested), '{uuid}/file.csv?x=1', or a non-UUID flow prefix like 'myflow/file.csv'.","commonSituations":"Clients passing just the basename after upload and assuming the server infers the flow; folder-upload UIs preserving subdirectory structure in names; template code hardcoding relative paths.","solutions":["Always send the full canonical form: lowercase flow UUID + '/' + filename as returned by the upload endpoint","Flatten any subdirectory structure — upload files individually and reference them by basename under the flow id","Validate client-side with the same regex before submit"],"exampleFix":"import re\nPUB = re.compile(r'^([0-9a-fA-F-]{36})/([^/\\\\]+)$')\n# before\n{ \"files\": [\"uploads/data.csv\"] }  # 400 Invalid file path format\n# after\n{ \"files\": [PUB and \"3fa85f64-5717-4562-b3fc-2c963f66afa6/data.csv\"] }","handlingStrategy":"type-guard","validationCode":"const PUB = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\/[^/\\\\]+$/;\nconst files = raw.filter(f => PUB.test(f));","typeGuard":"const UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;\nconst isPublicFilePath = (f) => typeof f === 'string' && f.includes('/') && UUID.test(f.split('/')[0]) && /^[^/\\\\]+$/.test(f.slice(f.indexOf('/') + 1));","tryCatchPattern":null,"preventionTips":["Always reference files as '{flow-uuid}/{basename}' exactly as returned by upload","Flatten subdirectories before upload","Share the validation regex between client and server contracts"],"tags":["security","path-traversal","http-400","validation","public-api"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}