{"record":{"id":"b840a51fdf80c2d6","repo":"conductor-oss/conductor","slug":"access-denied-file-name-filename-is-blocked","errorCode":null,"errorMessage":"Access denied: file name '{fileName}' is blocked","messagePattern":"Access denied: file name '(.+?)' is blocked","errorType":"validation","errorClass":"DocumentAccessDeniedException","httpStatus":null,"severity":"critical","filePath":"ai/src/main/java/org/conductoross/conductor/ai/document/DocumentAccessPolicy.java","lineNumber":311,"sourceCode":"        for (String prefix : blockedPathPrefixes) {\n            String expandedPrefix = expandHome(prefix);\n            if (normalizedPath.startsWith(expandedPrefix)) {\n                throw new DocumentAccessDeniedException(\n                        \"Access denied: path matches blocked prefix '\" + prefix + \"'\");\n            }\n        }\n    }\n\n    private void checkBlockedFileNames(String normalizedPath) {\n        String fileName = extractFileName(normalizedPath);\n        if (fileName == null || fileName.isEmpty()) {\n            return;\n        }\n        String lowerFileName = fileName.toLowerCase();\n\n        for (String blocked : DEFAULT_BLOCKED_FILE_NAMES) {\n            if (lowerFileName.equals(blocked.toLowerCase())) {\n                throw new DocumentAccessDeniedException(\n                        \"Access denied: file name '\" + fileName + \"' is blocked\");\n            }\n        }\n        for (String blocked : blockedFileNames) {\n            if (lowerFileName.equals(blocked.toLowerCase())) {\n                throw new DocumentAccessDeniedException(\n                        \"Access denied: file name '\" + fileName + \"' is blocked\");\n            }\n        }\n    }\n\n    private void checkBlockedHosts(String location) {\n        String host = extractHost(location);\n        if (host == null || host.isEmpty()) {\n            return;\n        }\n        String lowerHost = host.toLowerCase();\n","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/ai/src/main/java/org/conductoross/conductor/ai/document/DocumentAccessPolicy.java#L293-L329","documentation":"Thrown by DocumentAccessPolicy.checkBlockedFileNames when the last path component exactly matches (case-insensitive) one of the built-in DEFAULT_BLOCKED_FILE_NAMES (e.g. .env, id_rsa, credentials.json, service-account.json, terraform.tfvars, private.key). DocumentAccessDeniedException (SecurityException). The check runs even when the directory is allowed, so a blocked filename inside an allowed dir is still denied.","triggerScenarios":"A loader/upload targets a file whose basename is a known credential/secret filename: .env, .npmrc, id_ed25519, keystore.jks, terraform.tfstate, application_default_credentials.json, etc.","commonSituations":"A workflow reads project files for an LLM and hits .env; an upload references a service-account.json; a path computed from user input ends in a protected filename.","solutions":["Rename the file you need to a basename that is not on the built-in denylist, or access its content through a non-file channel.","Confirm the file is not a real secret — if it is, it should never be passed to a document loader.","Sanitize any LLM/user-supplied filename so it cannot resolve to a protected basename."],"exampleFix":"// before\nloader.download(\"/data/imports/.env\")\n// after — rename the source file to a non-blocked name\nloader.download(\"/data/imports/app-config.env.txt\")","handlingStrategy":"validation","validationCode":"// Reject protected filenames before the loader sees them\nString name = path.substring(path.lastIndexOf('/') + 1).toLowerCase();\nif (Set.of(\".env\",\"id_rsa\",\"credentials.json\",\"private.key\",\"terraform.tfstate\").contains(name)) {\n    throw new IllegalArgumentException(\"Refusing protected filename: \" + path);\n}","typeGuard":null,"tryCatchPattern":"try {\n    loader.download(path);\n} catch (SecurityException e) {\n    // built-in filename denylist — do not weaken policy; rename the source file\n    throw new IllegalArgumentException(\"Filename blocked by security policy: \" + path, e);\n}","preventionTips":["Never pass real secret files (.env, keys, tfstate, service-account.json) to a document loader.","Rename non-secret files that collide with protected basenames.","Sanitize user/LLM-supplied filenames before file access."],"tags":["security","access-control","document-loader","secrets","denylist"],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}