{"record":{"id":"fcdc44c60e4cc84f","repo":"Mintplex-Labs/anything-llm","slug":"invalid-folder-name","errorCode":null,"errorMessage":"Invalid folder name.","messagePattern":"Invalid folder name\\.","errorType":"validation","errorClass":"Error","httpStatus":500,"severity":"warning","filePath":"server/endpoints/document.js","lineNumber":22,"sourceCode":"const {\n  flexUserRoleValid,\n  ROLES,\n} = require(\"../utils/middleware/multiUserProtected\");\nconst { validatedRequest } = require(\"../utils/middleware/validatedRequest\");\nconst fs = require(\"fs\");\nconst path = require(\"path\");\n\nfunction documentEndpoints(app) {\n  if (!app) return;\n  app.post(\n    \"/document/create-folder\",\n    [validatedRequest, flexUserRoleValid([ROLES.admin, ROLES.manager])],\n    async (request, response) => {\n      try {\n        const { name } = reqBody(request);\n        const storagePath = path.join(documentsPath, normalizePath(name));\n        if (!isWithin(path.resolve(documentsPath), path.resolve(storagePath)))\n          throw new Error(\"Invalid folder name.\");\n\n        if (fs.existsSync(storagePath)) {\n          response.status(500).json({\n            success: false,\n            message: \"Folder by that name already exists\",\n          });\n          return;\n        }\n\n        fs.mkdirSync(storagePath, { recursive: true });\n        response.status(200).json({ success: true, message: null });\n      } catch (e) {\n        console.error(e);\n        response.status(500).json({\n          success: false,\n          message: `Failed to create folder: ${e.message} `,\n        });\n      }","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/endpoints/document.js#L4-L40","documentation":"Functionally identical to error 125 but thrown by the internal (non-v1-API) endpoint POST /document/create-folder used by the frontend UI. Same isWithin/normalizePath guard against the resolved folder path escaping documentsPath. The only difference is the error string ('Invalid folder name.' vs 'Invalid path name') and the auth middleware (flexUserRoleValid admin/manager rather than API key).","triggerScenarios":"The web UI submitting a folder name containing '../', an absolute path, or an empty string that resolves to the documents root. Same root causes as error 125.","commonSituations":"A browser extension or custom UI forwarded a path with separators; a copy-paste folder name included a leading slash; the documents storage directory was misconfigured so even legitimate names resolve outside it.","solutions":["Use a plain folder name without separators or '..': 'my-folder'.","Ensure the documentsPath setting points to the intended storage root.","Strip path separators in the client before submitting.","Treat this as expected behavior for malicious input — do not relax isWithin."],"exampleFix":"// before\n{ name: '/absolute/folder' }\n// after\n{ name: 'absolute-folder' }","handlingStrategy":"validation","validationCode":"function safeFolderName(name) {\n  if (typeof name !== 'string' || name.length === 0) return null;\n  if (name.includes('..') || name.includes('/') || name.includes('\\\\') || path.isAbsolute(name)) return null;\n  return name;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await createFolder(name);\n} catch (e) {\n  if (e.message === 'Invalid folder name.') return res.status(400).json({ success: false, message: 'Use a plain folder name without separators' });\n  throw e;\n}","preventionTips":["Use plain folder names in the UI.","Strip separators on the client before submit.","Treat the error as expected for malicious input — keep the guard."],"tags":["filesystem","path-traversal","security","documents","validation"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}