{"record":{"id":"9561a416451d16f2","repo":"jeecgboot/JeecgBoot","slug":"error-9561a4","errorCode":null,"errorMessage":"原始接口路径不能包含 ..","messagePattern":"原始接口路径不能包含 \\.\\.","errorType":"validation","errorClass":"JeecgBootBizTipException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java","lineNumber":284,"sourceCode":"                throw new JeecgBootBizTipException(\"原始接口路径必须以 / 开头，或填写完整的 http(s) URL\");\n            }\n            if (decoded.startsWith(\"//\") || decoded.startsWith(\"/\\\\\")) {\n                throw new JeecgBootBizTipException(\"原始接口路径不能以 // 或 /\\\\ 开头\");\n            }\n            if (lower.contains(\"://\") || lower.startsWith(\"file:\") || lower.startsWith(\"ftp:\") || lower.startsWith(\"gopher:\")\n                    || lower.startsWith(\"jar:\") || lower.startsWith(\"netdoc:\")) {\n                throw new JeecgBootBizTipException(\"原始接口路径仅支持相对路径或 http(s) 完整URL\");\n            }\n        } else {\n            // 即便是完整URL，也禁止其它危险协议（防止 http://x@file:/... 之类的绕过场景）\n            String afterScheme = lower.substring(lower.indexOf(\"://\") + 3);\n            if (afterScheme.contains(\"file:\") || afterScheme.contains(\"ftp:\") || afterScheme.contains(\"gopher:\")\n                    || afterScheme.contains(\"jar:\") || afterScheme.contains(\"netdoc:\")) {\n                throw new JeecgBootBizTipException(\"原始接口路径不允许嵌套 file/ftp/gopher/jar/netdoc 等协议\");\n            }\n        }\n        if (decoded.contains(\"..\")) {\n            throw new JeecgBootBizTipException(\"原始接口路径不能包含 ..\");\n        }\n        //update-end---author:scott ---date:20260429  for：【issues/9590】微服务nginx部署openApi接口访问不到-----------\n    }\n\n    @GetMapping(\"/json\")\n    public SwaggerModel swaggerModel() {\n\n        SwaggerModel swaggerModel = new SwaggerModel();\n        swaggerModel.setSwagger(\"2.0\");\n        swaggerModel.setInfo(swaggerInfo());\n        swaggerModel.setHost(\"jeecg.com\");\n        swaggerModel.setBasePath(\"/jeecg-boot\");\n        swaggerModel.setSchemes(Lists.newArrayList(\"http\", \"https\"));\n\n        SwaggerTag swaggerTag = new SwaggerTag();\n        swaggerTag.setName(\"openapi\");\n        swaggerModel.setTags(Lists.newArrayList(swaggerTag));\n","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java#L266-L302","documentation":"Thrown when the decoded originUrl contains '..' anywhere. This is a path-traversal guard applied to both relative and full-URL forms, preventing escalation out of the intended path root (e.g. '/public/../private/secret').","triggerScenarios":"origin_url containing literal '..' such as '/app/../etc/passwd', '/a/..b', or values that decode from '%2e%2e' / '%252e%252e'.","commonSituations":"Path-traversal test payloads; generated URLs that include '..' for parent-folder references; note the check is a naive substring match, so a legitimate path segment like '/my..app/x' would also be rejected.","solutions":["Remove all '..' segments from origin_url; resolve the canonical absolute path instead.","If '..' appears inside an innocent token (e.g. a version folder 'v2..1'), rename the token to avoid the substring.","Normalize the path server-side with Paths.get(x).normalize() before display so users see the clean form."],"exampleFix":"// before: originUrl = \"/web/../sys/api\"\n// after:  originUrl = \"/sys/api\"","handlingStrategy":"validation","validationCode":"// Reject any '..' substring before submitting\nif (originUrl != null && originUrl.contains(\"..\")) {\n    // reject; the server's substring check is naive and will also catch '..' inside tokens\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Canonicalize paths with Paths.get(x).normalize() before display.","Avoid '..' anywhere in origin URLs, even inside token names.","Treat '..' in this field as a path-traversal signal in review."],"tags":["openapi","url-validation","path-traversal","security"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}