usebruno/bruno · error · Error

Invalid file name

Error message

Invalid file name

What it means

Path-traversal guard in renderer:export-collection-postman. After resolving dirPath + fileName, it verifies the resulting filePath starts with resolvedDir + path.sep (or equals it). Any fileName containing `../`, drive letters, or absolute paths that escapes resolvedDir triggers this throw.

Source

Thrown at packages/bruno-electron/src/ipc/collection.js:2637

      });

      return { success: true, filePath };
    } catch (error) {
      throw error;
    }
  });

  ipcMain.handle('renderer:export-collection-postman', async (event, dirPath, fileName, content, overwrite = false) => {
    try {
      if (!dirPath || !fs.existsSync(dirPath)) {
        throw new Error('Export location does not exist');
      }

      // ensure the resolved path is inside the export directory
      const resolvedDir = path.resolve(dirPath);
      const filePath = path.resolve(resolvedDir, fileName);
      if (!filePath.startsWith(resolvedDir + path.sep) && filePath !== resolvedDir) {
        throw new Error('Invalid file name');
      }

      if (!overwrite && fs.existsSync(filePath)) {
        throw new Error(`path: ${filePath} already exists`);
      }

      await writeFile(filePath, content);

      return { success: true, filePath };
    } catch (error) {
      return Promise.reject(error);
    }
  });

  ipcMain.handle('renderer:is-bruno-collection-zip', async (event, zipFilePath) => {
    try {
      const zip = new AdmZip(zipFilePath);
      const entries = zip.getEntries().map((e) => e.entryName);

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Sanitize fileName with path.basename(fileName) before passing it.
2. Reject any fileName containing path separators or null bytes on the renderer side.
3. If subdirectories are legitimately needed, explicit opt-in with allowlist.

Example fix

// before
ipcRenderer.invoke('renderer:export-collection-postman', dir, fileName, content);

// after
const safeName = path.basename(fileName).replace(/[\x00]/g, '');
if (!safeName) throw new Error('Invalid file name');
ipcRenderer.invoke('renderer:export-collection-postman', dir, safeName, content);

const path = require('path');
const safe = path.basename(fileName).replace(/[\x00/\\]/g, '');
if (!safe) throw new Error('Invalid file name');
// pass `safe` instead of fileName

try {
  await ipcRenderer.invoke('renderer:export-collection-postman', dirPath, safeName, content, overwrite);
} catch (err) {
  if (/Invalid file name/.test(err.message)) {
    // sanitize and retry with path.basename
  } else {
    throw err;
  }
}

When it happens

Trigger: Passing a fileName containing path separators or `..` segments so that path.resolve(resolvedDir, fileName) escapes resolvedDir.

Common situations: Malicious or malformed filename input (`../../../../etc/passwd`, absolute `/tmp/x`); user-typed names with slashes; conversion output with embedded path separators.

Related errors

• Export location does not exist
• path: ${filePath} already exists
• Invalid .env filename
• Unsupported environment type: ${environmentType}
• Single object export requires exactly one environment

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/f595f1fec7d60138. Report an issue: GitHub.