Unexpected token 'R', "RuntimeErr"... is not valid JSON -> in Edge

[PatrickTerlisten]

Hello everyone. I'm facing a strange issue, and currently I don't know if it's a config issue or some kind of bug. I have two instances of PrivateBin, pretty plain with local storage. After upgrading both of them to 2.0.3, I'm getting the error

Unexpected token 'R', "RuntimeErr"... is not valid JSON

when I'm trying to open a paste. The past is successfully saved but the error occurs upon opening. Two different OS (Ubuntu 24.04 with Apache vs. Alma 9.6 with NGINX).

Any hints where I should take a closer look at?

TIA!

[elrido]

Where exactly do you get this error? Is this in the webserver error log or in the browsers console?

If it's in the webserver log and coming from PHP, check that the file stored on disk is not damaged. You can skip the first line, the rest should be valid JSON. If you repeatedly get broken files on disk and not just that one, do check if your systems filesystem isn't damaged or for hardware faults, etc. Or check if your webserver has any security mechanisms that would lead to truncated POST requests and incomplete JSON being sent to PHP (though that should get caught before storing it on disk).

If it's in the browser, check the console to figure out which file causes this. If it's not something badly cached in the browser, check if you get the same broken JSON via curl or wget and if that is also the case, check if that file is already broken on disk or if some web server mechanism is truncating it during transmission.

In either case, attack the problem from both ends - figure out which exact file is the cause of the error, check if it is or isn't broken on disk, then work your way up the stack to isolate where the file get's mangled.

[PatrickTerlisten]

Thank you for your reply. I get this error in the browser after I click on a link to a file. I create a new file, get a link, open that link and I will get this message. On two (!) different PrivateBin instances, two different setups (Alma/ Podman/ Nginx on a VPS vs. Ubuntu/ Docker/ Apache2 on a Proxmox VM). That's the reasony why I'm a bit puzzled. Furthermore, podman/ docker logs will not give me any errors beside a HTTP 200 for the request after clicking the link. During more tests it seems, that short texts are okay and will be displayed without any error.

[elrido]

Ok, so that indicates the issue is not with the php backend, but with one of the layers in front of it. It's possible that it is with one of the webservers or reverse proxies limiting the requests to a certain size, which leads to incomplete messages being returned. See this diagram for some of the possible layers interfering with the response: https://github.com/PrivateBin/PrivateBin/wiki/Configuration#sizelimit

In the browser, I would suggest to open the web developer tools ([F12] key), select the network tab, navigate or open a link to one of the pastes you created that has the error and check if the response is indeed a truncated JSON.

On the backend side, check in the directory you mounted into your container if the corresponding file is damaged or not - you can find it in the subdirectory using find /<path>/<to>/<your>/<data>/<volume> -name <paste ID without hash here>*. For example, a paste with ID 112233445566778899 would live in a folder 11/22 and be called 112233445566778899.php. You can open these with cat or less or any text editor and it should let you verify that it is a non-truncated JSON.

[PatrickTerlisten]

Okay, after hours of troubleshooting I'm pretty confident that the issue is this security option in Edge "Enhance your security on the web". I had to disable this feature completly, even "Balanced" won't work. I was able to reproduce this issue with two different browser profiles and three PrivateBin instances, one of them was privatebin.net.

Hope this helps.

[elrido]

That is a great finding! Did you figure out a rough size limit to trigger this issue? You had mentioned earlier that it seemed to work with smaller documents. That would help me reproduce the issue, so we can figure out what it is doing differently on 2.0.3.

[PatrickTerlisten]

I would say something between 4 and 50 characters.

[rugk]

Thanks. Next time, please mind to fill out the issue template you choose, when you open an issue the next time. This makes it easier to troubleshoot issues or understand feature requests etc. E.g. we would have found out it is Edge.

Also you know any docs about what this "security feature" is supposed to do?

[elrido]

I tried reproducing it using our sponsored browserstack account. The setting is not enabled (there) by default, but even after turning it on and setting it to strict all of my samples still opened up fine. Does changing this setting require a restart of the browser? I attempted that, but after closing it, I can only reopen edge by launching a new session which resets the setting, as browserstack runs the apps in a kiosk mode that wont let you start new applications. :-(

If anyone other than OP can reproduce this, please share any findings you might get, so we can get to the bottom of this.

[PatrickTerlisten]

I had to close all browser processes and I had to create a new paste. It seems that the feature affects the data when a paste is created, therefore pasted that were created successfully can opened with or without the Edge feature enabled.Hinweis: Bitte beachten Sie, dass diese E-Mail zur Sicherstellung der Absenderauthentizität digital signiert wurde.Am 25.01.2026 um 08:31 schrieb El RIDO ***@***.***>: I tried reproducing it using our sponsored browserstack account. The setting is not enabled (there) by default, but even after turning it on and setting it to strict all of my samples still opened up fine. Does changing this setting require a restart of the browser? I attempted that, but after closing it, I can only reopen edge by launching a new session which resets the setting, as browserstack runs the apps in a kiosk mode that wont let you start new applications. :-( If anyone other than OP can reproduce this, please share any findings you might get, so we can get to the bottom of this. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>

[rugk]

So got access to a Edge and here are my testing results using privatebin.net:

• yes that setting needs a restart of the browser
• indeed, was not enabled by default
• here is an example paste created in edge with that settings: https://privatebin.net/?76466e3e5ea93b6b#HzuNGQQQsWZxW9RcDBwUUoU5joaoXE9Dkd38SpQT3yEp
• here is the docs Microsoft links, unfortunately in German: https://support.microsoft.com/de-de/microsoft-edge/verbessern-sie-ihre-sicherheit-im-web-mit-microsoft-edge-b8199f13-b21b-4a08-a806-daed31a1929d

Screenshot in German though (sorry):

So it seems not to be about that Edge setting (alone)? @PatrickTerlisten As this setting is not enabled by default, do you maybe are in a cooperate environment that has some security products/proxies etc. installed that may interfere here?

Edit: Ah okay you said more data, here some lorem ipsum also works? https://privatebin.net/?4f85a83a329f49d8#EnL9GMxRjuZ3UY1NJecbEE78vPiUxYdQhHao3igTwZA6