{"record":{"id":"eb938161692d27b7","repo":"danny-avila/LibreChat","slug":"invalid-file-path-cleanfilepath","errorCode":null,"errorMessage":"Invalid file path: ${cleanFilepath}","messagePattern":"Invalid file path: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/server/services/Files/Local/crud.js","lineNumber":244,"sourceCode":" * @returns {Promise<void>}\n *          A promise that resolves when the file has been successfully deleted, or throws an error if the\n *          file path is invalid or if there is an error in deletion.\n */\nconst deleteLocalFile = async (req, file) => {\n  const appConfig = req.config;\n  const { publicPath, uploads } = appConfig.paths;\n\n  /** Filepath stripped of query parameters (e.g., ?manual=true) */\n  const cleanFilepath = file.filepath.split('?')[0];\n\n  await deleteRagFile({ userId: req.user.id, file });\n\n  if (cleanFilepath.startsWith(`/uploads/${req.user.id}`)) {\n    const userUploadDir = path.join(uploads, req.user.id);\n    const basePath = cleanFilepath.split(`/uploads/${req.user.id}/`)[1];\n\n    if (!basePath) {\n      throw new Error(`Invalid file path: ${cleanFilepath}`);\n    }\n\n    const filepath = path.join(userUploadDir, basePath);\n\n    const rel = path.relative(userUploadDir, filepath);\n    if (rel.startsWith('..') || path.isAbsolute(rel) || rel.includes(`..${path.sep}`)) {\n      throw new Error(`Invalid file path: ${cleanFilepath}`);\n    }\n\n    await unlinkFile(filepath);\n    return;\n  }\n\n  const parts = cleanFilepath.split(path.sep);\n  const subfolder = parts[1];\n  if (!subfolder && parts[0] === EModelEndpoint.agents) {\n    logger.warn(`Agent File ${file.file_id} is missing filepath, may have been deleted already`);\n    return;","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/danny-avila/LibreChat/blob/5ff282f9006c436e561de1afd39a481bea1ef0d8/api/server/services/Files/Local/crud.js#L226-L262","documentation":"Thrown by deleteLocalFile when the cleaned filepath starts with /uploads/{userId} but has no path component after the user-specific prefix — meaning the filepath is exactly /uploads/{userId} or /uploads/{userId}/ with nothing following. The split produces an empty basePath, indicating a malformed or incomplete file path that cannot map to an actual file on disk.","triggerScenarios":"Calling deleteLocalFile(req, file) where file.filepath (after stripping query params) equals /uploads/{userId} or /uploads/{userId}/ — i.e., it references the user's upload directory root rather than a specific file within it.","commonSituations":"A database record has a truncated or corrupted filepath field that was accidentally set to the directory prefix. Or a file was partially created and the filepath was stored before the filename was appended. This is typically a data-integrity issue rather than a user-actionable condition.","solutions":["Inspect the file record in the database and verify file.filepath is a complete path like /uploads/{userId}/{file_id}__{filename}.","If the record is stale or corrupted, remove it from the database directly rather than attempting file deletion.","Audit the upload pipeline (uploadLocalFile) to ensure filepath is always fully constructed before being persisted.","Handle this error at the controller level and return a 404 or 422 with a message indicating the file path is invalid."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const cleanFilepath = file.filepath.split('?')[0];\nif (cleanFilepath.startsWith(`/uploads/${req.user.id}`)) {\n  const basePath = cleanFilepath.split(`/uploads/${req.user.id}/`)[1];\n  if (!basePath) {\n    throw new Error('File record has incomplete path — no filename component');\n  }\n}","typeGuard":"function hasCompleteUploadPath(filepath: string, userId: string): boolean {\n  const clean = filepath.split('?')[0];\n  const parts = clean.split(`/uploads/${userId}/`);\n  return parts.length === 2 && parts[1].length > 0;\n}","tryCatchPattern":"try {\n  await deleteLocalFile(req, file);\n} catch (error) {\n  if (error.message.startsWith('Invalid file path')) {\n    // data integrity issue — log and skip\n    logger.warn(`Skipping deletion of malformed file record ${file.file_id}`);\n    return;\n  }\n  throw error;\n}","preventionTips":["Validate file.filepath is a complete path before persisting it to the database.","Audit database records for truncated or malformed paths.","Always construct upload paths with both userId and a server-generated filename."],"tags":["file-deletion","local-storage","data-integrity","input-validation"],"backgroundTag":null,"analyzedSha":"5ff282f9006c436e561de1afd39a481bea1ef0d8","analyzedAt":"2026-08-12T21:38:08.145Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}