{"record":{"id":"f4ecb8265d13e74f","repo":"langflow-ai/langflow","slug":"invalid-file-entry","errorCode":null,"errorMessage":"Invalid file entry","messagePattern":"Invalid file entry","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"src/backend/base/langflow/api/utils/flow_utils.py","lineNumber":161,"sourceCode":"    r\"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})/([^/\\\\]+)$\"\n)\n_PUBLIC_FILE_REJECTED_SUBSTRINGS = (\"\\x00\", \"..\", \"\\\\\")\n\n\ndef validate_public_files(files: list[str] | None, source_flow_id: uuid.UUID) -> None:\n    \"\"\"Reject file references that aren't ``{source_flow_id}/{basename}``.\n\n    Mitigates GHSA-rcjh-r59h-gq37: an unauthenticated build must not be\n    able to address files outside its own flow's storage namespace.\n    Called from any endpoint that accepts caller-supplied file references\n    under a public-access boundary.\n    \"\"\"\n    if not files:\n        return\n    expected_flow_id = str(source_flow_id).lower()\n    for entry in files:\n        if not isinstance(entry, str) or not entry:\n            raise HTTPException(status_code=400, detail=\"Invalid file entry\")\n        if any(token in entry for token in _PUBLIC_FILE_REJECTED_SUBSTRINGS):\n            raise HTTPException(status_code=400, detail=\"Invalid file path\")\n        match = _PUBLIC_FILE_PATH_RE.match(entry)\n        if not match:\n            raise HTTPException(status_code=400, detail=\"Invalid file path format\")\n        flow_id_segment, basename = match.group(1), match.group(2)\n        if flow_id_segment.lower() != expected_flow_id:\n            raise HTTPException(status_code=400, detail=\"File not in this flow's namespace\")\n        if basename in (\".\", \"..\"):\n            raise HTTPException(status_code=400, detail=\"Invalid filename\")\n\n\ndef compute_virtual_flow_id(\n    identifier: str | uuid.UUID,\n    flow_id: uuid.UUID,\n    *,\n    principal_type: Literal[\"user\", \"client\"] | None = None,\n) -> uuid.UUID:","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/utils/flow_utils.py#L143-L179","documentation":"HTTP 400 from validate_public_files when a file entry in the files list is not a non-empty string. This validator guards the unauthenticated/public build boundary (GHSA-rcjh-r59h-gq37): every caller-supplied file reference must be a proper string in the form {source_flow_id}/{basename}.","triggerScenarios":"Submitting a public/unauthenticated build request whose files array contains null, 0, empty string '', or a non-string value (number, object) instead of a 'flow-uuid/filename' string.","commonSituations":"Client SDKs serializing optional file fields as null instead of omitting them; form inputs producing empty strings; JSON built dynamically where a filename variable is undefined.","solutions":["Send only string entries formatted as '{source_flow_id}/{basename}'","Omit the files field entirely or send an empty list when no files are needed — validate_public_files returns early on falsy/empty","Sanitize client-side: files = [f for f in files if isinstance(f, str) and f]"],"exampleFix":"// before\n{ \"files\": [null, \"uuid-.../data.csv\"] }  // 400 Invalid file entry\n// after\n{ \"files\": [\"uuid-.../data.csv\"] }","handlingStrategy":"validation","validationCode":"const cleanFiles = (files) => (files ?? []).filter(f => typeof f === 'string' && f.length > 0);","typeGuard":"const isValidFileEntry = (f) => typeof f === 'string' && f.length > 0 && /^[0-9a-fA-F-]{36}\\/[^/\\\\]+$/.test(f);","tryCatchPattern":null,"preventionTips":["Never include null/empty placeholders in files arrays — omit them","Type files as string[] in client schemas","Run the same shape check client-side before submit"],"tags":["security","path-traversal","http-400","public-api","validation"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}