{"record":{"id":"326d4dcc2b6a5da3","repo":"elunez/eladmin","slug":"gif-jpg-png-jpeg","errorCode":null,"errorMessage":"文件格式错误！, 仅支持 gif jpg png jpeg 格式","messagePattern":"文件格式错误！, 仅支持 gif jpg png jpeg 格式","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/system/service/impl/UserServiceImpl.java","lineNumber":225,"sourceCode":"            // 清除缓存\n            flushCache(user.getUsername());\n            // 强制退出\n            onlineUserService.kickOutForUsername(user.getUsername());\n        });\n        // 重置密码\n        userRepository.resetPwd(ids, pwd);\n    }\n\n    @Override\n    @Transactional(rollbackFor = Exception.class)\n    public Map<String, String> updateAvatar(MultipartFile multipartFile) {\n        // 文件大小验证\n        FileUtil.checkSize(properties.getAvatarMaxSize(), multipartFile.getSize());\n        // 验证文件上传的格式\n        String image = \"gif jpg png jpeg\";\n        String fileType = FileUtil.getExtensionName(multipartFile.getOriginalFilename());\n        if(fileType != null && !image.contains(fileType)){\n            throw new BadRequestException(\"文件格式错误！, 仅支持 \" + image +\" 格式\");\n        }\n        User user = userRepository.findByUsername(SecurityUtils.getCurrentUsername());\n        String oldPath = user.getAvatarPath();\n        File file = FileUtil.upload(multipartFile, properties.getPath().getAvatar());\n        user.setAvatarPath(Objects.requireNonNull(file).getPath());\n        user.setAvatarName(file.getName());\n        userRepository.save(user);\n        if (StringUtils.isNotBlank(oldPath)) {\n            FileUtil.del(oldPath);\n        }\n        @NotBlank String username = user.getUsername();\n        flushCache(username);\n        return new HashMap<String, String>(1) {{\n            put(\"avatar\", file.getName());\n        }};\n    }\n\n    @Override","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/system/service/impl/UserServiceImpl.java#L207-L243","documentation":"BadRequestException thrown in UserServiceImpl.updateAvatar when the uploaded avatar file's extension is not one of 'gif jpg png jpeg'. FileUtil.checkSize has already validated size; this check derives the extension from the original filename and rejects anything outside the whitelist. Note the substring-containment check ('gif jpg png jpeg'.contains(ext)), which is loose but functional for typical extensions.","triggerScenarios":"POST /api/users/updateAvatar with a .webp, .bmp, .svg, .heic or extension-less file.","commonSituations":"Modern phones defaulting to HEIC/WEBP uploads; users renaming files without changing format assumptions; drag-dropping screenshots saved as unusual formats.","solutions":["Convert the image to PNG or JPG before uploading.","Take a screenshot/save-as PNG instead of HEIC/WEBP on mobile.","If you own the deployment, extend the whitelist string in UserServiceImpl and redeploy — but keep SVG out (XSS risk)."],"exampleFix":"// before: rejected upload\navatar.webp → 400 文件格式错误\n\n// after\nconvert avatar.webp avatar.png; upload avatar.png","handlingStrategy":"validation","validationCode":"const ALLOWED = ['gif','jpg','png','jpeg'];\nconst ext = file.name.split('.').pop()?.toLowerCase();\nif (!ALLOWED.includes(ext)) { alert('仅支持 gif/jpg/png/jpeg'); return; }","typeGuard":"const isAllowedAvatar = (f: File) => ['gif','jpg','png','jpeg'].includes(f.name.split('.').pop()?.toLowerCase() ?? '');","tryCatchPattern":"catch (BadRequestException e) when (e.getMessage().contains(\"文件格式错误\")) { // prompt conversion to PNG/JPG }","preventionTips":["Restrict the file picker with accept='image/gif,image/jpeg,image/png'","Convert HEIC/WEBP client-side (canvas) before upload","Never add svg to the whitelist — stored XSS via the avatar"],"tags":["eladmin","user","avatar","file-upload","validation"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}