{"record":{"id":"9d3250daecc0bf46","repo":"kataras/iris","slug":"name-s-error-w","errorCode":null,"errorMessage":"name: %s: error: %w","messagePattern":"name: (.+?): error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/router/fs.go","lineNumber":591,"sourceCode":"\t\treturn err\n\t}\n\n\t// link to parent directory\n\t_, err = ctx.WriteString(\"<li><span style=\\\"width: 150px; float: left; display: inline-block;\\\">drwxrwxrwx</span><a href=\\\"./\\\">../</a><li>\")\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor _, d := range dirs {\n\t\tif !dirOptions.ShowHidden && IsHidden(d) {\n\t\t\tcontinue\n\t\t}\n\n\t\tname := toBaseName(d.Name())\n\n\t\tu, err := url.Parse(ctx.Request().RequestURI) // clone url and remove query (#1882).\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"name: %s: error: %w\", name, err)\n\t\t}\n\t\tu.RawQuery = \"\"\n\n\t\tupath := url.URL{Path: path.Join(u.String(), name)}\n\n\t\tdownloadAttr := \"\"\n\t\tif dirOptions.Attachments.Enable && !d.IsDir() {\n\t\t\tdownloadAttr = \" download\" // fixes chrome Resource interpreted, other browsers will just ignore this <a> attribute.\n\t\t}\n\n\t\tviewName := name\n\t\tif d.IsDir() {\n\t\t\tviewName += \"/\"\n\t\t}\n\n\t\t// name may contain '?' or '#', which must be escaped to remain\n\t\t// part of the URL path, and not indicate the start of a query\n\t\t// string or fragment.","sourceCodeStart":573,"sourceCodeEnd":609,"githubUrl":"https://github.com/kataras/iris/blob/7bedaf55a0b64bbb2248a5845a2c60d81a30996a/core/router/fs.go#L573-L609","documentation":"In the embedded file server's DirList renderer, the handler parses the incoming request URI with url.Parse to build listing links (#1882 fix). If the raw RequestURI is malformed and cannot be parsed, listing of that directory entry fails and this wrapped error is returned, naming the entry being processed.","triggerScenarios":"Serving a directory listing (fs.DirList / Party.DirOptions with ShowList enabled) while a client sends a request whose RequestURI is not a valid URL (bad percent-encodings like %zz, illegal control characters or malformed query strings).","commonSituations":"Hand-crafted or crawler HTTP requests with invalid percent-encoding; proxies forwarding raw, un-normalized URIs; fuzzing or security scanning tools hitting the file server.","solutions":["Inspect the wrapped cause: it is an url.Parse error — fix the request URI that triggered it","Normalize/sanitize request URIs in middleware before they reach the file server","Ensure clients use properly URL-encoded paths (e.g. %20 not raw spaces)","If serving behind a proxy, enable URI normalization on the proxy"],"exampleFix":"// middleware before serving\nfunc sanitizeURI(ctx iris.Context) {\n    if _, err := url.ParseRequestURI(ctx.Request().RequestURI); err != nil {\n        ctx.StatusCode(iris.StatusBadRequest)\n        return\n    }\n    ctx.Next()\n}","handlingStrategy":"validation","validationCode":"func validURI(raw string) bool {\n    _, err := url.ParseRequestURI(raw)\n    return err == nil\n}","typeGuard":null,"tryCatchPattern":"err := fileServer(ctx)\nif err != nil && strings.Contains(err.Error(), \"url parse\") {\n    ctx.StatusCode(iris.StatusBadRequest)\n    return\n}","preventionTips":["Add middleware rejecting malformed RequestURI with 400 before the file server","Enable URI normalization at the reverse proxy","Keep clients and generated links properly percent-encoded","Monitor logs for repeated bad-URI requests (scanner activity)"],"tags":["go","http","url-parsing","file-server"],"backgroundTag":"malformed-request-uri","analyzedSha":"7bedaf55a0b64bbb2248a5845a2c60d81a30996a","analyzedAt":"2026-08-30T20:38:16.250Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}