gitbutlerapp/gitbutler · error

File suffix '{}' is not allowed. Must be one of: {}

Error message

File suffix '{}' is not allowed. Must be one of: {}

What it means

from_editor writes text to a temp file and launches an external or built-in editor; the file suffix is restricted to an explicit allowlist (.txt, .md, .patch) to keep editor behavior predictable. Any other suffix is a programming error by the internal caller and is rejected before any editor or temp file is touched.

Source

Thrown at crates/but/src/tui/get_text.rs:66

}

/// Launches the user's preferred text editor to edit some `initial_text`,
/// identified by a `filename_safe_intent` to help the user understand what's wanted of them.
/// Note that this string must be valid in filenames.
///
/// If the user has an external editor configured (via `GIT_EDITOR`, `core.editor`, or `EDITOR`),
/// that editor is used. Otherwise, the built-in TUI editor is launched.
///
/// Returns the edited text (*without known encoding*) verbatim.
pub fn from_editor(
    filename_safe_intent: &str,
    initial_text: &str,
    rest_text: Option<&str>,
    file_suffix: &str,
) -> Result<BString> {
    const ALLOWED_SUFFIXES: &[&str] = &[".txt", ".md", ".patch"]; // feel free to add more allowed suffixes
    if !ALLOWED_SUFFIXES.contains(&file_suffix) {
        bail!(
            "File suffix '{}' is not allowed. Must be one of: {}",
            file_suffix,
            ALLOWED_SUFFIXES.join(", ")
        );
    }

    match get_editor_command() {
        Some(editor_cmd) => from_external_editor(
            &editor_cmd,
            filename_safe_intent,
            initial_text,
            rest_text,
            file_suffix,
        ),
        None => from_builtin_editor(filename_safe_intent, initial_text, rest_text),
    }
}

View on GitHub (pinned to caf1f223d3)

Solutions

1. Use one of the allowed suffixes: .txt, .md, or .patch
2. If a new suffix is genuinely needed, add it to ALLOWED_SUFFIXES in crates/but/src/tui/get_text.rs (the comment invites additions)
3. Sanitize user-supplied extensions by mapping them onto .txt

Example fix

// before
from_editor("commit-msg", &text, None, ".log")?;
// after
from_editor("commit-msg", &text, None, ".txt")?;

const ALLOWED_SUFFIXES: &[&str] = &[".txt", ".md", ".patch"];
fn is_allowed_suffix(suffix: &str) -> bool {
    ALLOWED_SUFFIXES.contains(&suffix)
}
// guard every call site:
assert!(is_allowed_suffix(file_suffix), "unsupported suffix {file_suffix}");

When it happens

Trigger: An internal call site passes a suffix outside ALLOWED_SUFFIXES - e.g. ".log", "txt" without a leading dot, or a user-supplied extension forwarded unchecked into file_suffix.

Common situations: Adding new TUI flows that edit files, refactors that change the suffix constant, forwarding untrusted filenames into the editor helper.

Related errors

• Visible worktree {name} was listed more than once
• cannot mix mark sources
• cannot mark files from multiple commits
• Editor cancelled
• committing stack assignments is not supported. Use `but comm

AI-assisted analysis of gitbutlerapp/gitbutler@caf1f223d3 (2026-08-20). Data as JSON: /api/errors/ebb0969c3210a770. Report an issue: GitHub.