{"record":{"id":"afd9d431667cd786","repo":"FlowiseAI/Flowise","slug":"invalid-chatflowid-format-must-be-a-valid-uuid","errorCode":null,"errorMessage":"Invalid chatflowId format - must be a valid UUID","messagePattern":"Invalid chatflowId format - must be a valid UUID","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/storage/BaseStorageProvider.ts","lineNumber":78,"sourceCode":"     * Shared utility for getting the base storage path\n     */\n    protected getStoragePath(): string {\n        const storagePath = process.env.BLOB_STORAGE_PATH\n            ? path.join(process.env.BLOB_STORAGE_PATH)\n            : path.join(getUserHome(), '.flowise', 'storage')\n\n        if (!fs.existsSync(storagePath)) {\n            fs.mkdirSync(storagePath, { recursive: true })\n        }\n        return storagePath\n    }\n\n    /**\n     * Shared utility for validating chatflowId format (UUID)\n     */\n    protected validateChatflowId(chatflowId: string): void {\n        if (!chatflowId || !isValidUUID(chatflowId)) {\n            throw new Error('Invalid chatflowId format - must be a valid UUID')\n        }\n    }\n\n    /**\n     * Shared utility for checking path traversal attempts\n     */\n    protected validatePathSecurity(...paths: string[]): void {\n        for (const p of paths) {\n            if (p && isPathTraversal(p)) {\n                throw new Error('Invalid path characters detected')\n            }\n        }\n    }\n\n    /**\n     * Shared utility for building a storage path from components\n     */\n    protected buildPath(...paths: string[]): string {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/storage/BaseStorageProvider.ts#L60-L96","documentation":"Thrown by BaseStorageProvider.validateChatflowId when the supplied chatflowId is missing or does not pass isValidUUID. UUID validation prevents a caller from injecting path segments or traversal sequences through the chatflowId component of a storage path.","triggerScenarios":"Any storage call (read, write, list, delete) where chatflowId is undefined, an empty string, a malformed UUID, or a deliberately injected value like `../../`. The guard is `!chatflowId || !isValidUUID(chatflowId)` at BaseStorageProvider.ts:77.","commonSituations":"A route handler that forgets to validate the chatflowId param; a stale/bookmarked URL with a truncated ID; an attack probing the storage endpoint with crafted IDs.","solutions":["Confirm the chatflowId is a valid UUID (v4) before invoking any storage method.","Validate the parameter at the API boundary (e.g. with a UUID route constraint or Zod schema).","Return 400 to the client on invalid IDs rather than letting them reach storage."],"exampleFix":"// before\nawait provider.streamStorageFile(req.params.id, chatId, fileName, orgId)\n// after\nconst chatflowId = req.params.id\nif (!isValidUUID(chatflowId)) return res.status(400).send('invalid chatflowId')\nawait provider.streamStorageFile(chatflowId, chatId, fileName, orgId)","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\nfunction requireValidChatflowId(id: string): void {\n  if (!id || !UUID_RE.test(id)) throw new Error('Invalid chatflowId format - must be a valid UUID')\n}","typeGuard":"function isValidChatflowId(id: unknown): id is string {\n  return typeof id === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)\n}","tryCatchPattern":null,"preventionTips":["Validate chatflowId as UUID at the route boundary.","Return 400 for malformed IDs before reaching storage.","Never accept free-form IDs from clients."],"tags":["validation","uuid","security","storage"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}