toeverything/AFFiNE · error

Refusing to read mobile payload outside cache dir: ${fileUrl

Error message

Refusing to read mobile payload outside cache dir: ${fileUrl}

What it means

Guard thrown when a pathname segment for a mobile payload file URL fails traversal validation: after decoding, a segment was empty, was '.' or '..', or contained a path separator (/ or \), meaning the URL tries to escape the app's cache directory. This is a security sentinel preventing arbitrary file reads outside the sandbox.

Source

Thrown at packages/frontend/apps/mobile-shared/src/nbstore/payload.ts:55

  try {
    decodedSegments = pathname
      .split('/')
      .filter(Boolean)
      .map(segment => {
        const decoded = decodeURIComponent(segment);
        if (
          !decoded ||
          decoded === '.' ||
          decoded === '..' ||
          decoded.includes('/') ||
          decoded.includes('\\')
        ) {
          throw new Error('path traversal');
        }
        return decoded;
      });
  } catch {
    throw new Error(
      `Refusing to read mobile payload outside cache dir: ${fileUrl}`
    );
  }

  const fileName = decodedSegments.at(-1);
  const bucket = decodedSegments.at(-2);
  const cacheDir = decodedSegments.at(-3);
  const parentDir = decodedSegments.at(-4);
  const cacheParent = decodedSegments.at(-5);

  if (
    !fileName ||
    !bucket ||
    !cacheDir ||
    !parentDir ||
    cacheDir !== MOBILE_PAYLOAD_CACHE_DIR ||
    !MOBILE_PAYLOAD_BUCKET_PATTERN.test(bucket) ||
    !MOBILE_PAYLOAD_FILE_PATTERN.test(fileName) ||

View on GitHub (pinned to b4c8548c09)

Solutions

1. Only request payload files located inside the app cache directory.
2. Check the resolved path against the cache dir prefix before issuing the request; regenerate the token if it points elsewhere.

When it happens

Trigger: Thrown in assertMobileCachePath when path segments fail traversal checks (empty, dot, dotdot, separators) or when the path does not match the expected cache layout of nbstore-blob-cache under an allowed cache/tmp parent with hex bucket and .blob filename.

Common situations: Hit when a token points outside the app's sanctioned cache directories, e.g. tampered paths or wrong bucket/file naming. Treat it as a security guard; regenerate the payload rather than loosening the path.

AI-assisted analysis of toeverything/AFFiNE@b4c8548c09 (2026-08-18). Data as JSON: /api/errors/1e931b64b28fcf15. Report an issue: GitHub.