{"record":{"id":"ef561a1fce4321ea","repo":"mikefarah/yq","slug":"file-operations-have-been-disabled","errorCode":null,"errorMessage":"file operations have been disabled","messagePattern":"file operations have been disabled","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/yqlib/operator_load.go","lineNumber":67,"sourceCode":"\tif documents.Len() == 0 {\n\t\t// return null candidate\n\t\treturn &CandidateNode{Kind: ScalarNode, Tag: \"!!null\"}, nil\n\t} else if documents.Len() == 1 {\n\t\tcandidate := documents.Front().Value.(*CandidateNode)\n\t\treturn candidate, nil\n\n\t}\n\tsequenceNode := &CandidateNode{Kind: SequenceNode}\n\tfor doc := documents.Front(); doc != nil; doc = doc.Next() {\n\t\tsequenceNode.AddChild(doc.Value.(*CandidateNode))\n\t}\n\treturn sequenceNode, nil\n}\n\nfunc loadStringOperator(d *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {\n\tlog.Debugf(\"loadString\")\n\tif ConfiguredSecurityPreferences.DisableFileOps {\n\t\treturn Context{}, fmt.Errorf(\"file operations have been disabled\")\n\t}\n\n\tvar results = list.New()\n\n\tfor el := context.MatchingNodes.Front(); el != nil; el = el.Next() {\n\t\tcandidate := el.Value.(*CandidateNode)\n\n\t\trhs, err := d.GetMatchingNodes(context.SingleReadonlyChildContext(candidate), expressionNode.RHS)\n\t\tif err != nil {\n\t\t\treturn Context{}, err\n\t\t}\n\t\tif rhs.MatchingNodes.Front() == nil {\n\t\t\treturn Context{}, fmt.Errorf(\"filename expression returned nil\")\n\t\t}\n\t\tnameCandidateNode := rhs.MatchingNodes.Front().Value.(*CandidateNode)\n\n\t\tfilename := nameCandidateNode.Value\n","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/mikefarah/yq/blob/8b5af0694bb82b41d4ae180fac9972029066f90a/pkg/yqlib/operator_load.go#L49-L85","documentation":"loadString (and load) checked ConfiguredSecurityPreferences.DisableFileOps and found file operations switched off — a hard security sentinel. The evaluation never touches the filesystem; the operator is unconditionally refused because this yq invocation was run with file access disabled.","triggerScenarios":"Thrown at pkg/yqlib/operator_load.go:67 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-run yq without the security flag that disables file ops","Read the file externally (cat file | yq ...) and drop the load/loadString call","Only use load in trusted contexts where file operations are permitted"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"8b5af0694bb82b41d4ae180fac9972029066f90a","analyzedAt":"2026-09-05T10:57:22.766Z","contentChangedAt":"2026-09-05T10:57:22.766Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}