{"record":{"id":"0794da89cb6aa8d9","repo":"jeecgboot/JeecgBoot","slug":"error-0794da","errorCode":null,"errorMessage":"文件名包含非法字符，无法处理该文件","messagePattern":"文件名包含非法字符，无法处理该文件","errorType":"validation","errorClass":"JeecgBootException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/handler/EmbeddingHandler.java","lineNumber":905,"sourceCode":"        String filePath = metadataJson.getString(LLMConsts.KNOWLEDGE_DOC_METADATA_FILEPATH);\n        AssertUtils.assertNotEmpty(\"请先上传文件\", filePath);\n        filePath = ensureFile(filePath);\n\n        File docFile = new File(filePath);\n        String fileType = FilenameUtils.getExtension(filePath);\n        if (!docFile.exists()\n                || \"txt\".equalsIgnoreCase(fileType)\n                || \"md\".equalsIgnoreCase(fileType)) {\n            return ;\n        }\n\n        // 安全校验：拒绝文件名/路径中含有 Shell 注入字符的文件，防止命令注入\n        try {\n            CommandExecUtil.validateFilePath(docFile.getAbsolutePath());\n            CommandExecUtil.validateFilePath(docFile.getName());\n        } catch (IllegalArgumentException e) {\n            log.error(\"文件路径包含非法字符，拒绝执行 MinerU 解析: {}\", e.getMessage());\n            throw new JeecgBootException(\"文件名包含非法字符，无法处理该文件\");\n        }\n\n        // 使用 String[] 数组构建命令，避免 split(\" \") 带来的参数边界问题\n        String[] command;\n        if (oConvertUtils.isNotEmpty(knowConfigBean.getCondaEnv())) {\n            command = new String[]{\"conda\", \"run\", \"-n\", knowConfigBean.getCondaEnv(), \"magic-pdf\"};\n        } else {\n            command = new String[]{\"magic-pdf\"};\n        }\n\n        String outputPath = docFile.getParentFile().getAbsolutePath();\n        String[] args = {\n                \"-p\", docFile.getAbsolutePath(),\n                \"-o\", outputPath,\n        };\n\n        try {\n            String execLog = CommandExecUtil.execCommand(command, args);","sourceCodeStart":887,"sourceCodeEnd":923,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/handler/EmbeddingHandler.java#L887-L923","documentation":"Thrown by EmbeddingHandler.parseFileByMinerU() when CommandExecUtil.validateFilePath() detects dangerous characters in either the file's absolute path or its name. The IllegalArgumentException from validateFilePath is caught and re-thrown as a user-facing JeecgBootException. This is a security guard preventing command injection through filenames passed to the external magic-pdf command.","triggerScenarios":"A knowledge-base document file whose absolute path or filename contains any of: & | ; < > ` $ ! \" ' \\r \\n. The file passes earlier checks but fails the injection guard before being passed as an argument to the conda/magic-pdf command.","commonSituations":"User uploaded a file with special characters in the original filename that were preserved through the upload pipeline; the upload directory path itself contains a restricted character; a downloaded web resource filename includes quotes or semicolons.","solutions":["Rename the source file to remove special characters (& | ; < > ` $ ! \" ' and newlines) before uploading.","Sanitize filenames at upload time in CommonUtils.uploadLocal to strip or replace dangerous characters.","If the upload directory path contains restricted characters, relocate the upload directory."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Sanitize filename before it reaches MinerU processing\nString safeName = docFile.getName().replaceAll(\"[&|;<>`$!\\\"'\\r\\n]\", \"_\");\nFile safeFile = new File(docFile.getParentFile(), safeName);\n// verify before calling parseFileByMinerU\nCommandExecUtil.validateFilePath(safeFile.getAbsolutePath());\nCommandExecUtil.validateFilePath(safeFile.getName());","typeGuard":"private static boolean isMinerUSafeFilename(String name) {\n    return name != null && !Pattern.compile(\"[&|;<>`$!\\\"'\\r\\n]\").matcher(name).find();\n}","tryCatchPattern":"try {\n    parseFileByMinerU(doc);\n} catch (JeecgBootException e) {\n    if (e.getMessage().contains(\"文件名包含非法字符\")) {\n        log.warn(\"File rejected by MinerU safety check: {}\", doc.getId());\n        throw new JeecgBootException(\"文件名含特殊字符，请重命名后重新上传\");\n    }\n    throw e;\n}","preventionTips":["Sanitize uploaded filenames at upload time to remove shell-dangerous characters.","Store files with UUID-based names internally instead of preserving user-provided filenames.","Add frontend validation to warn users about invalid characters in filenames."],"tags":["security","filename-injection","command-injection","mineru","rag"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}