{"record":{"id":"b46397237dc15d04","repo":"jeecgboot/JeecgBoot","slug":"error-b46397","errorCode":null,"errorMessage":"文件路径包含非法字符，已拒绝处理: ","messagePattern":"文件路径包含非法字符，已拒绝处理: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/handler/CommandExecUtil.java","lineNumber":68,"sourceCode":"     *\n     * @param arg 待校验参数\n     * @throws IllegalArgumentException 若参数包含危险字符\n     */\n    public static void validateArg(String arg) {\n        if (arg != null && SHELL_INJECTION_PATTERN.matcher(arg).find()) {\n            throw new IllegalArgumentException(\"命令参数包含非法字符，已拒绝执行: \" + arg);\n        }\n    }\n\n    /**\n     * 校验文件路径，拒绝包含危险字符（防止文件名注入）\n     *\n     * @param filePath 待校验文件路径\n     * @throws IllegalArgumentException 若文件路径包含危险字符\n     */\n    public static void validateFilePath(String filePath) {\n        if (filePath != null && FILENAME_INJECTION_PATTERN.matcher(filePath).find()) {\n            throw new IllegalArgumentException(\"文件路径包含非法字符，已拒绝处理: \" + filePath);\n        }\n    }\n\n    /**\n     * 执行命令行\n     *\n     * @param command 脚本目录\n     * @param args    参数\n     * @author chenrui\n     * @date 2024/4/09 10:30\n     */\n    public static String execCommand(String[] command, String[] args) throws IOException {\n\n        if (null == command || command.length == 0) {\n            throw new IllegalArgumentException(\"命令不能为空\");\n        }\n\n        if (null != args && args.length > 0) {","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/handler/CommandExecUtil.java#L50-L86","documentation":"Thrown by CommandExecUtil.validateFilePath(String) when a file path contains characters matched by FILENAME_INJECTION_PATTERN: & | ; < > ` $ ! \" ' \\r \\n. Unlike validateArg, this pattern allows backslashes (needed for Windows paths) but additionally blocks quotes. It is a security guard against filename injection when paths are passed to external commands.","triggerScenarios":"Calling validateFilePath on a path containing any of the blocked characters. For example: a file named data\"report.pdf, a path with a semicolon (common in some generated temp names), or a file containing single quotes in its name.","commonSituations":"User-uploaded file with special characters in the original filename; a downloaded web resource whose URL-derived filename contains a semicolon or quote; OS-generated temp paths containing restricted characters.","solutions":["Rename or sanitize the file before calling validateFilePath — strip or replace blocked characters in the filename portion only.","If the file comes from user upload, sanitize the original filename at upload time (in CommonUtils.uploadLocal or equivalent).","Use FilenameUtils.getName() to isolate the filename and clean only that portion, preserving the directory path."],"exampleFix":"// before\nCommandExecUtil.validateFilePath(docFile.getAbsolutePath());\n// throws if filename = data;report.pdf\n\n// after\nString safeName = docFile.getName().replaceAll(\"[&|;<>`$!\\\"'\\\\r\\\\n]\", \"_\");\nFile safeFile = new File(docFile.getParentFile(), safeName);\nCommandExecUtil.validateFilePath(safeFile.getAbsolutePath());","handlingStrategy":"validation","validationCode":"String safePath = filePath == null ? null\n    : filePath.replaceAll(\"[&|;<>`$!\\\"'\\r\\n]\", \"_\");\nCommandExecUtil.validateFilePath(safePath);","typeGuard":"private static boolean isSafeFilePath(String path) {\n    return path == null || !Pattern.compile(\"[&|;<>`$!\\\"'\\r\\n]\").matcher(path).find();\n}","tryCatchPattern":"try {\n    CommandExecUtil.validateFilePath(filePath);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Rejected file path with dangerous characters: {}\", e.getMessage());\n    throw new JeecgBootException(\"文件名包含非法字符，请重命名文件\");\n}","preventionTips":["Sanitize filenames at upload time to strip quotes, semicolons, and other special characters.","Use UUID-based filenames for stored files instead of preserving user-provided names.","When validating paths (not just filenames), use validateFilePath rather than validateArg to allow backslashes."],"tags":["security","filename-injection","validation","illegal-argument"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}