{"record":{"id":"b484282834009e6d","repo":"hyperledger/fabric","slug":"illegal-file-mode-detected-for-file-s-o","errorCode":null,"errorMessage":"illegal file mode detected for file %s: %o","messagePattern":"illegal file mode detected for file (.+?): %o","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/platforms/java/platform.go","lineNumber":83,"sourceCode":"\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check name for conforming path\n\t\t// --------------------------------------------------------------------------------------\n\t\tif !filesToMatch.MatchString(header.Name) || filesToIgnore.MatchString(header.Name) {\n\t\t\treturn fmt.Errorf(\"illegal file detected in payload: \\\"%s\\\"\", header.Name)\n\t\t}\n\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Check that file mode makes sense\n\t\t// --------------------------------------------------------------------------------------\n\t\t// Acceptable flags:\n\t\t//      ISREG      == 0100000\n\t\t//      -rw-rw-rw- == 0666\n\t\t//\n\t\t// Anything else is suspect in this context and will be rejected\n\t\t// --------------------------------------------------------------------------------------\n\t\tif header.Mode&^0o100666 != 0 {\n\t\t\treturn fmt.Errorf(\"illegal file mode detected for file %s: %o\", header.Name, header.Mode)\n\t\t}\n\t}\n\treturn nil\n}\n\n// WritePackage writes the java chaincode package\nfunc (p *Platform) GetDeploymentPayload(path string) ([]byte, error) {\n\tlogger.Debugf(\"Packaging java project from path %s\", path)\n\n\tif path == \"\" {\n\t\tlogger.Error(\"ChaincodeSpec's path cannot be empty\")\n\t\treturn nil, errors.New(\"ChaincodeSpec's path cannot be empty\")\n\t}\n\n\t// trim trailing slash if it exists\n\tif path[len(path)-1] == '/' {\n\t\tpath = path[:len(path)-1]\n\t}","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/platforms/java/platform.go#L65-L101","documentation":"Each file entry's tar mode must contain only regular-file and rw-rw-rw- permission bits (0o100666 mask). Any entry with extra bits — setuid/setgid, sticky, directory, symlink, or executable bits — is rejected to keep packages safe to extract.","triggerScenarios":"ValidateCodePackage reads a tar header where header.Mode &^ 0o100666 != 0, e.g. directories (ISDIR bit), executables (0755 x bits), or special files inside the package.","commonSituations":"Tarring a directory tree with `tar -czf` so directory entries are included; packaging scripts or build artifacts with +x permissions; using system tar with preservation of special file modes (setgid dirs).","solutions":["Package only regular files, not directory entries","Normalize file modes to 0666 (or 0644) before tarring: `chmod -R a-x` then set perms, or use a packaging script that forces modes","Remove executables/symlinks/special files from the packaged tree","Build the tar programmatically (like util.WriteFolderToTarPackage) forcing regular-file headers"],"exampleFix":"// before\nexec.Command(\"tar\", \"-czf\", \"pkg.tgz\", \"src\", \"pom.xml\") // includes dirs, exec bits\n// after\n// use a writer that emits only regular-file headers with mode 0644, e.g. the SDK's packaging utilities","handlingStrategy":"validation","validationCode":"func precheckTarModes(tarPath string) error {\n    f, _ := os.Open(tarPath); defer f.Close()\n    gr, err := gzip.NewReader(f); if err != nil { return err }\n    tr := tar.NewReader(gr)\n    for {\n        h, err := tr.Next()\n        if err == io.EOF { return nil }\n        if err != nil { return err }\n        if h.Mode&^0o100666 != 0 { return fmt.Errorf(\"bad mode %o on %s\", h.Mode, h.Name) }\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := platform.ValidateCodePackage(code); err != nil {\n    if strings.Contains(err.Error(), \"illegal file mode detected\") {\n        // rebuild tar forcing mode 0644 headers\n    }\n}","preventionTips":["Normalize permissions (chmod 644 files) before packaging","Exclude directories, symlinks, and executables from the tar","Build packages programmatically with fixed header modes instead of system tar"],"tags":["chaincode","java","tar","permissions"],"backgroundTag":"illegal-file-mode-in-package","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}