{"record":{"id":"5fb315ffd480a543","repo":"theonedev/onedev","slug":"invalid-content-disposition-disposition","errorCode":null,"errorMessage":"Invalid content disposition: ${disposition}","messagePattern":"Invalid content disposition: (.+?)","errorType":"exception","errorClass":"NotAcceptableException","httpStatus":406,"severity":"warning","filePath":"server-core/src/main/java/io/onedev/server/web/resource/RawBlobResource.java","lineNumber":112,"sourceCode":"\t\t\tresponse.setContentLength(blob.getLfsPointer().getObjectSize());\n\t\telse \n\t\t\tresponse.setContentLength(blob.getSize());\n\t\t\n\t\tif (!ObjectId.isId(revision))\n\t\t\tresponse.disableCaching();\n\n\t\ttry {\n\t\t\tresponse.setFileName(URLEncoder.encode(blob.getIdent().getName(), StandardCharsets.UTF_8.name()));\n\t\t} catch (UnsupportedEncodingException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t\t\n\t\tString disposition = params.get(PARAM_DISPOSITION).toOptionalString();\n\t\tif (disposition != null) {\n\t\t\ttry {\n\t\t\t\tresponse.setContentDisposition(ContentDisposition.valueOf(disposition));\n\t\t\t} catch (IllegalArgumentException e) {\n\t\t\t\tthrow new NotAcceptableException(\"Invalid content disposition: \" + disposition);\n\t\t\t}\n\t\t}\n\t\t\n\t\tresponse.setWriteCallback(new WriteCallback() {\n\n\t\t\t@Override\n\t\t\tpublic void writeData(Attributes attributes) throws IOException {\n\t\t\t\ttry (InputStream is = getInputStream(blob)) {\n\t\t\t\t\tlong contentLength;\n\t\t\t\t\tif (blob.getLfsPointer() != null)\n\t\t\t\t\t\tcontentLength = blob.getLfsPointer().getObjectSize() - 1;\n\t\t\t\t\telse\n\t\t\t\t\t\tcontentLength = blob.getSize() - 1;\n\t\t\t\t\t\n\t\t\t\t\tLongRange range = WicketUtils.getRequestContentRange(contentLength);\n\t\t\t\t\ttry {\n\t\t\t\t\t\tIOUtils.copyRange(is, attributes.getResponse().getOutputStream(), range);\n\t\t\t\t\t} catch (Exception e) {","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/resource/RawBlobResource.java#L94-L130","documentation":"RawBlobResource accepts an optional disposition URL parameter that must be one of the ContentDisposition enum values (e.g. attachment, inline). Passing any other string makes ContentDisposition.valueOf throw IllegalArgumentException, which the resource converts into NotAcceptableException.","triggerScenarios":"Raw blob request with ?disposition=<invalid value> where the value is not a valid ContentDisposition enum constant (case-sensitive).","commonSituations":"Typos like 'attachement' or 'inline;' in generated download links; passing a filename instead of a disposition keyword; case mismatch ('Attachment' vs 'attachment').","solutions":["Use an exact valid ContentDisposition value (e.g. attachment or inline) in the disposition parameter.","Check casing — the value is matched against enum constants exactly.","Remove the disposition parameter if you don't need to control content disposition."],"exampleFix":"// before\nString url = \"/~raw/proj/main/a.zip?disposition=Attachment\";\n// after\nString url = \"/~raw/proj/main/a.zip?disposition=attachment\";","handlingStrategy":"validation","validationCode":"Set.of(\"attachment\",\"inline\").contains(disposition) /* or check ContentDisposition enum */","typeGuard":"boolean isValidDisposition(String d) { return d == null || Arrays.stream(ContentDisposition.values()).anyMatch(c -> c.name().equalsIgnoreCase(d)); }","tryCatchPattern":"try { /* request */ } catch (NotAcceptableException e) { /* fix disposition param */ }","preventionTips":["Only pass lowercase enum-constant values for the disposition parameter.","Omit the parameter unless you specifically need attachment/inline behavior."],"tags":["http","enum","invalid-argument"],"backgroundTag":"invalid-enum-value","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}