toeverything/AFFiNE · error

Invalid mobile payload token: malformed file URL

Error message

Invalid mobile payload token: malformed file URL

What it means

assertMobileCachePath parses the file URL and throws 'malformed file URL' if URL parsing fails or the protocol is not file:, then validates the path resolves into the app's cache directories — an anti-tamper check on payload file references.

Source

Thrown at packages/frontend/apps/mobile-shared/src/nbstore/payload.ts:33

  if (!trimmedPath) {
    throw new Error('Invalid mobile payload token: empty file path');
  }

  return trimmedPath.startsWith('file://')
    ? trimmedPath
    : `file://${trimmedPath}`;
}

function assertMobileCachePath(fileUrl: string): void {
  let pathname: string;
  try {
    const parsedUrl = new URL(fileUrl);
    if (parsedUrl.protocol !== 'file:') {
      throw new Error('unexpected protocol');
    }
    pathname = parsedUrl.pathname;
  } catch {
    throw new Error('Invalid mobile payload token: malformed file URL');
  }

  let decodedSegments: string[];
  try {
    decodedSegments = pathname
      .split('/')
      .filter(Boolean)
      .map(segment => {
        const decoded = decodeURIComponent(segment);
        if (
          !decoded ||
          decoded === '.' ||
          decoded === '..' ||
          decoded.includes('/') ||
          decoded.includes('\\')
        ) {
          throw new Error('path traversal');
        }

View on GitHub (pinned to b4c8548c09)

Solutions

1. Verify the token encodes a valid file:// URL; re-encode the file URL with proper escaping before constructing the token.
2. Reject and regenerate malformed tokens at the source.

When it happens

Trigger: Thrown in assertMobileCachePath when the token path cannot be parsed as a URL or does not use the file: protocol, so the payload location is rejected as malformed.

Common situations: Occurs when a blob token contains a hand-edited or non-file URL instead of a device cache path. The payload must be re-created from the original blob source.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of toeverything/AFFiNE@b4c8548c09 (2026-08-18). Data as JSON: /api/errors/e807fd957c512132. Report an issue: GitHub.