{"record":{"id":"0c43ac39670f4bfe","repo":"theonedev/onedev","slug":"invalid-request-path-0c43ac","errorCode":null,"errorMessage":"Invalid request path","messagePattern":"Invalid request path","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/web/resource/ArtifactResource.java","lineNumber":51,"sourceCode":"\tprivate static final long serialVersionUID = 1L;\n\n\tprivate static final String PARAM_PROJECT = \"project\";\n\n\tprivate static final String PARAM_BUILD = \"build\";\n\n\t@Override\n\tprotected ResourceResponse newResourceResponse(Attributes attributes) {\n\t\tPageParameters params = attributes.getParameters();\n\n\t\tLong projectId = params.get(PARAM_PROJECT).toLong();\n\t\tLong buildNumber = params.get(PARAM_BUILD).toLong();\n\t\t\n\t\tList<String> pathSegments = new ArrayList<>();\n\n\t\tfor (int i = 0; i < params.getIndexedCount(); i++) {\n\t\t\tString pathSegment = params.get(i).toString();\n\t\t\tif (pathSegment.contains(\"..\"))\n\t\t\t\tthrow new ExplicitException(\"Invalid request path\");\n\t\t\tif (pathSegment.length() != 0)\n\t\t\t\tpathSegments.add(pathSegment);\n\t\t}\n\t\t\n\t\tif (pathSegments.isEmpty())\n\t\t\tthrow new ExplicitException(\"Artifact path has to be specified\");\n\t\t\n\t\tString artifactPath = Joiner.on(\"/\").join(pathSegments);\n\t\t\n\t\tFileInfo fileInfo = null;\n\t\tif (!SecurityUtils.isSystem()) {\n\t\t\tProject project = OneDev.getInstance(ProjectService.class).load(projectId);\n\t\t\t\n\t\t\tBuild build = OneDev.getInstance(BuildService.class).find(project, buildNumber);\n\n\t\t\tif (build == null) {\n\t\t\t\tString message = String.format(\"Unable to find build (project: %s, build number: %d)\", \n\t\t\t\t\t\tproject.getPath(), buildNumber);","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/resource/ArtifactResource.java#L33-L69","documentation":"ArtifactResource serves build artifact files. While reconstructing the artifact path from the indexed URL path segments, it throws ExplicitException 'Invalid request path' if any segment contains '..'. This is a path-traversal guard preventing clients from escaping the artifact directory via relative path segments.","triggerScenarios":"Requesting an artifact URL whose path contains a '..' segment anywhere, e.g. /~resources/artifact/1/5/../../etc/passwd, or a file name that literally includes '..'.","commonSituations":"Naive scripts joining paths with .. to shorten the artifact path; path templates where a variable resolves to '..'; attempted directory traversal (often by scanners).","solutions":["Remove '..' segments from the artifact URL path and reference the artifact with its full literal path from the build root","If building the URL from a relative path, normalize it against the artifact root in your script before requesting","If a legitimate artifact file name contains '..', rename the file in the build script; such names cannot be fetched via this resource"],"exampleFix":"// before\nGET /~resources/artifact?project=1&build=5&path=dist/../secrets\n// after\nGET /~resources/artifact?project=1&build=5&path=dist/app.jar","handlingStrategy":"validation","validationCode":"if (artifactPath.split('/').some(seg => seg === '..' || seg.includes('..'))) throw new Error('artifact path must not contain .. segments: ' + artifactPath);","typeGuard":"function isSafeArtifactPath(p) { return typeof p === 'string' && p.length > 0 && !p.includes('..'); }","tryCatchPattern":null,"preventionTips":["Normalize relative paths against the artifact root before building URLs","Never join user input into artifact URLs unvalidated","Rename artifact files that contain '..' at build time"],"tags":["security","path-traversal","artifact"],"backgroundTag":"path-traversal-blocked","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}