{"record":{"id":"32786aca2e141363","repo":"frohoff/ysoserial","slug":"unsupported-command-command-parts-wicket1","errorCode":null,"errorMessage":"Unsupported command ${command} ${parts}","messagePattern":"Unsupported command (.+?) (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/main/java/ysoserial/payloads/Wicket1.java","lineNumber":77,"sourceCode":"        \tthrow new IllegalArgumentException(\"Bad command format.\");\n        }\n\n        if (\"copyAndDelete\".equals(parts[0])) {\n            return copyAndDelete(parts[1], parts[2]);\n        }\n        else if (\"write\".equals(parts[0])) {\n            return write(parts[1], parts[2].getBytes(\"US-ASCII\"));\n        }\n        else if (\"writeB64\".equals(parts[0]) ) {\n            return write(parts[1], Base64.decodeBase64(parts[2]));\n        }\n        else if (\"writeOld\".equals(parts[0]) ) {\n            return writeOldJRE(parts[1], parts[2].getBytes(\"US-ASCII\"));\n        }\n        else if (\"writeOldB64\".equals(parts[0]) ) {\n            return writeOldJRE(parts[1], Base64.decodeBase64(parts[2]));\n        }\n        throw new IllegalArgumentException(\"Unsupported command \" + command + \" \" + Arrays.toString(parts));\n    }\n\n\tpublic void release(DiskFileItem obj) throws Exception {\n\t}\n\n    private static DiskFileItem copyAndDelete ( String copyAndDelete, String copyTo ) throws IOException, Exception {\n        return makePayload(0, copyTo, copyAndDelete, new byte[1]);\n    }\n\n    // writes data to a random filename (update_<per JVM random UUID>_<COUNTER>.tmp)\n    private static DiskFileItem write ( String dir, byte[] data ) throws IOException, Exception {\n        return makePayload(data.length + 1, dir, dir + \"/whatever\", data);\n    }\n\n    // writes data to an arbitrary file\n    private static DiskFileItem writeOldJRE(String file, byte[] data) throws IOException, Exception {\n        return makePayload(data.length + 1, file + \"\\0\", file, data);\n    }","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/frohoff/ysoserial/blob/218bcffcaaa904a4e392f0c15d9e2874533635a3/src/main/java/ysoserial/payloads/Wicket1.java#L59-L95","documentation":"Wicket1.getObject() throws this IllegalArgumentException when the command is well-formed (3 parts) but parts[0] does not match any supported operation ('copyAndDelete', 'write', 'writeOld', 'writeOldB64'). The dispatch chain falls through all branches and rethrows the original command plus the parsed parts for diagnosis.","triggerScenarios":"Calling getObject(\"<unknownOp>;<a>;<b>\") where <unknownOp> is anything other than copyAndDelete, write, writeOld, or writeOldB64 — e.g. 'copy;src;dst', 'Write;...', or a misspelled 'writeOldb64'.","commonSituations":"Case-sensitivity mistakes ('Write' instead of 'write'), using operation names from other ysoserial payloads, misspelling the base64 variant ('writeoldb64' vs 'writeOldB64'), or trailing whitespace making 'write ' !== 'write'.","solutions":["Use one of the exact operation names: 'copyAndDelete', 'write', 'writeOld', or 'writeOldB64' (case-sensitive, no extra whitespace).","Trim the command string before passing it in so leading/trailing spaces don't corrupt parts[0].","If you intended base64 content on an old JRE, use 'writeOldB64'; for raw US-ASCII bytes on old JREs use 'writeOld'."],"exampleFix":"// before\nString command = \"copy;/tmp/src;/tmp/dst\";\n// after\nString command = \"copyAndDelete;/tmp/src;/tmp/dst\";","handlingStrategy":"validation","validationCode":"private static final Set<String> WICKET1_OPS = new HashSet<>(Arrays.asList(\"copyAndDelete\", \"write\", \"writeOld\", \"writeOldB64\"));\npublic static void validateWicket1Op(String command) {\n    String op = command.split(\";\", -1)[0].trim();\n    if (!WICKET1_OPS.contains(op)) {\n        throw new IllegalArgumentException(\"Unsupported Wicket1 op '\" + op + \"'; use copyAndDelete|write|writeOld|writeOldB64\");\n    }\n}","typeGuard":"public static boolean isSupportedWicket1Op(String command) {\n    if (command == null) return false;\n    String op = command.split(\";\", -1)[0].trim();\n    return op.equals(\"copyAndDelete\") || op.equals(\"write\") || op.equals(\"writeOld\") || op.equals(\"writeOldB64\");\n}","tryCatchPattern":"try {\n    DiskFileItem item = new Wicket1().getObject(command);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Unsupported command\")) {\n        System.err.println(\"Op must be exactly one of: copyAndDelete, write, writeOld, writeOldB64 (case-sensitive)\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Copy operation names exactly (case-sensitive) from Wicket1's source: copyAndDelete, write, writeOld, writeOldB64.","Trim the command before dispatch to avoid whitespace in parts[0].","Centralize command construction in one helper with a whitelist of supported operations."],"tags":["java","unsupported-operation","payload-generation"],"backgroundTag":"unsupported-operation","analyzedSha":"218bcffcaaa904a4e392f0c15d9e2874533635a3","analyzedAt":"2026-09-12T01:53:58.488Z","contentChangedAt":"2026-09-12T01:53:58.488Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}