What causes "file name is required" in vxcontrol/pentagi?

Ensure the client always sends a filename in the multipart part (Content-Disposition filename field)

file name is required

Error message

file name is required

What it means

SanitizeResourceFileName requires a non-empty basename; it strips whitespace and returns this error when nothing remains. The function's job is to reduce an input to a safe bare filename (dropping any directory components) and validate it.

Source

Thrown at backend/pkg/resources/resources.go:185

	}

	return rel, nil
}

// SanitizeResourceDir is like SanitizeResourcePath but also accepts an empty
// string to mean "root". It returns "" for root, or a clean relative path.
func SanitizeResourceDir(p string) (string, error) {
	if strings.TrimSpace(p) == "" {
		return "", nil
	}
	return SanitizeResourcePath(p)
}

// SanitizeResourceFileName strips path separators and validates the basename.
func SanitizeResourceFileName(fileName string) (string, error) {
	trimmed := strings.TrimSpace(fileName)
	if trimmed == "" {
		return "", fmt.Errorf("file name is required")
	}

	normalized := strings.ReplaceAll(trimmed, "\\", "/")
	cleanName := path.Base(path.Clean("/" + normalized))

	if err := validatePathComponent(cleanName); err != nil {
		return "", err
	}
	return cleanName, nil
}

// FilePath builds the virtual file path for a file named name inside dir.
// dir may be "" (root).
func FilePath(dir, name string) string {
	if dir == "" {
		return name
	}
	return dir + "/" + name

View on GitHub (pinned to ea665308ba)

Solutions

Ensure the client always sends a filename in the multipart part (Content-Disposition filename field)
Check for emptiness in your handler before calling the API and return a user-facing message
Provide a generated fallback name (e.g. timestamp or hash-based) when the original is absent
Verify the frontend form marks the file input as required

Example fix

// before
name, err := resources.SanitizeResourceFileName(fileHeader.Filename)
// after
fname := strings.TrimSpace(fileHeader.Filename)
if fname == "" {
    fname = fmt.Sprintf("upload-%d.bin", time.Now().UnixNano())
}
name, err := resources.SanitizeResourceFileName(fname)

Defensive patterns

Strategy: validation

Validate before calling

func hasFileName(fh *multipart.FileHeader) bool {
	return fh != nil && strings.TrimSpace(fh.Filename) != ""
}

Try / catch

name, err := resources.SanitizeResourceFileName(fh.Filename)
if err != nil {
	if strings.Contains(err.Error(), "file name is required") {
		return http.StatusBadRequest
	}
	return err
}

Prevention

Mark file inputs as required in forms and enforce filename presence server-side
Generate a fallback name when clients omit the multipart filename
Check Content-Disposition parsing — some HTTP clients omit filename for blob bodies
Return 400 with a user-facing message instead of leaking the raw wrapped error

When it happens

Trigger: Calling SanitizeResourceFileName with "", " ", or a string that becomes empty after trimming, from callers like UploadResources or anonymous handler closures processing multipart file fields.

Common situations: A multipart upload with no filename part (e.g. curl --data-binary without -F filename, or a programmatically built form); a frontend sending an empty name field; a missing Content-Disposition filename header.

Related errors

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/3cd56e25d79843e8. Report an issue: GitHub.