{"record":{"id":"00b0f06885162000","repo":"theonedev/onedev","slug":"incorrect-file-name-requested","errorCode":null,"errorMessage":"Incorrect file name requested","messagePattern":"Incorrect file name requested","errorType":"http","errorClass":"ClientException","httpStatus":400,"severity":"error","filePath":"server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java","lineNumber":528,"sourceCode":"\t\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_NOT_FOUND);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_NOT_FOUND);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tvar version = decodePath(pathSegments.get(0));\n\t\t\t\t\t\tvar fileName = decodePath(pathSegments.get(1));\n\t\t\t\t\t\tif (isGet) {\n\t\t\t\t\t\t\tsessionService.run(() -> {\n\t\t\t\t\t\t\t\tvar project = checkProject(projectId, false);\n\t\t\t\t\t\t\t\tvar pack = packService.findByNameAndVersion(project, TYPE, packageName, version);\n\t\t\t\t\t\t\t\tif (pack != null) {\n\t\t\t\t\t\t\t\t\tvar packData = (NpmData) pack.getData();\n\t\t\t\t\t\t\t\t\tif (!packData.getFileName().equals(fileName)) \n\t\t\t\t\t\t\t\t\t\tthrow new ClientException(SC_BAD_REQUEST, \"Incorrect file name requested\");\n\t\t\t\t\t\t\t\t\tPackBlob packBlob;\n\t\t\t\t\t\t\t\t\tif ((packBlob = packBlobService.checkPackBlob(projectId, packData.getFileSha256BlobHash())) != null) {\n\t\t\t\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\t\t\t\tresponse.setContentType(MediaType.APPLICATION_OCTET_STREAM);\n\t\t\t\t\t\t\t\t\t\t\tpackBlobService.downloadBlob(packBlob.getProject().getId(), packData.getFileSha256BlobHash(), response.getOutputStream());\n\t\t\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_OK);\n\t\t\t\t\t\t\t\t\t\t} catch (IOException e) {\n\t\t\t\t\t\t\t\t\t\t\tthrow new RuntimeException(e);\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_NOT_FOUND);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_NOT_FOUND);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} else if (isDelete) {\n\t\t\t\t\t\t\tLockUtils.run(getLockName(projectId, packageName), () -> {","sourceCodeStart":510,"sourceCodeEnd":546,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-npm/src/main/java/io/onedev/server/plugin/pack/npm/NpmPackHandler.java#L510-L546","documentation":"Thrown when downloading an npm tarball via a two-segment path (<version>/<fileName>) and the requested file name does not match the file name recorded in the published package's NpmData. OneDev serves the tarball only under the exact name stored at publish time and rejects mismatches with HTTP 400.","triggerScenarios":"GET .../-/<version>/<fileName> where packData.getFileName() differs from the fileName path segment — e.g. requesting my-pkg-1.0.tgz when 1.0.0.tgz was published.","commonSituations":"npm client resolving a tarball URL from a stale or foreign registry metadata document; URL normalization shortening or altering the version in the filename; mirrored packages whose tarball names differ from OneDev's stored name.","solutions":["Request the tarball with the exact file name stored at publish time (usually <packageName>-<version>.tgz).","Fetch the package metadata from OneDev and use the dist.tarball URL it returns instead of a hand-built URL.","If the package was published with a nonstandard tarball name, republish with the conventional name or adjust the client to use the stored name."],"exampleFix":"// before\nnpm install my-pkg@1.0.0 --registry ...  (client builds my-pkg-1.0.tgz)\n// after\nuse dist.tarball from registry metadata: /npm/proj/my-pkg/-/my-pkg-1.0.0.tgz","handlingStrategy":"validation","validationCode":"// Request the tarball only under the exact published file name\nconst expected = `${pkg.name.replace(/^@[^/]+\\//, '')}-${pkg.version}.tgz`;\nif (!tarballUrl.endsWith(expected)) console.warn(`Use ${expected} as the tarball file name`);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fetch metadata from OneDev and follow its dist.tarball URL.","Publish with conventional tarball names (<name>-<version>.tgz).","Avoid manually rewriting tarball URLs from other registries."],"tags":["npm","http-400","tarball-download"],"backgroundTag":"invalid-query-parameter","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}