{"record":{"id":"b9e5a3dae3be0a57","repo":"perwendel/spark","slug":"bad-request","errorCode":null,"errorMessage":"Bad request","messagePattern":"Bad request","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"src/main/java/spark/staticfiles/StaticFilesConfiguration.java","lineNumber":76,"sourceCode":"\n    /**\n     * Attempt consuming using either static resource handlers or jar resource handlers\n     *\n     * @param httpRequest  The HTTP servlet request.\n     * @param httpResponse The HTTP servlet response.\n     * @return true if consumed, false otherwise.\n     * @throws IOException in case of IO error.\n     */\n    public boolean consume(HttpServletRequest httpRequest,\n                           HttpServletResponse httpResponse) throws IOException {\n        try {\n            if (consumeWithFileResourceHandlers(httpRequest, httpResponse)) {\n                return true;\n            }\n\n        } catch (DirectoryTraversal.DirectoryTraversalDetection directoryTraversalDetection) {\n            httpResponse.setStatus(400);\n            httpResponse.getWriter().write(\"Bad request\");\n            httpResponse.getWriter().flush();\n            LOG.warn(directoryTraversalDetection.getMessage() + \" directory traversal detection for path: \"\n                             + httpRequest.getPathInfo());\n        }\n        return false;\n    }\n\n\n    private boolean consumeWithFileResourceHandlers(HttpServletRequest httpRequest,\n                                                    HttpServletResponse httpResponse) throws IOException {\n        if (staticResourceHandlers != null) {\n\n            for (AbstractResourceHandler staticResourceHandler : staticResourceHandlers) {\n\n                AbstractFileResolvingResource resource = staticResourceHandler.getResource(httpRequest);\n\n                if (resource != null && resource.isReadable()) {\n","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/perwendel/spark/blob/1973e402f5d4c1442ad34a1d38ed0758079f7773/src/main/java/spark/staticfiles/StaticFilesConfiguration.java#L58-L94","documentation":"StaticFilesConfiguration.consume catches DirectoryTraversalDetection (a path-traversal attempt detected in the request path), sets HTTP 400, writes the literal body 'Bad request' and logs a warning. Clients see 'Bad request' when spark blocks an apparent ../ traversal against static resources.","triggerScenarios":"Requesting a static resource whose normalized path escapes the configured static folder, e.g. GET /../../etc/passwd or encoded variants (%2e%2e%2f) that resolve outside the static files root.","commonSituations":"Security scanners or curl tests probing for directory traversal; misconfigured reverse proxies forwarding '..' segments; clients with relative links containing ../ generated by buggy template code.","solutions":["Do not serve paths containing traversal segments — fix the client/URL to reference resources within the static root.","Catch DirectoryTraversalDetection at your own layer if you want a custom 4xx response instead of the default 'Bad request' body.","Audit proxies/templates so ../ sequences never reach the static handler.","Register static resources with the correct root so legitimate deep paths are not misdetected."],"exampleFix":"// before\ncurl http://host/scripts/../../etc/passwd\n// after\ncurl http://host/scripts/app.js // path stays inside the static root","handlingStrategy":"try-catch","validationCode":"boolean isTraversal(String path) {\n    String norm = path.replace(\"\\\\\", \"/\");\n    return norm.contains(\"../\") || norm.contains(\"..%2F\") || norm.contains(\"%2e%2e\");\n}","typeGuard":null,"tryCatchPattern":"// DirectoryTraversalDetection is caught internally by consume(); to customize:\ntry {\n    boolean served = staticFiles.consume(request, response);\n} catch (Exception e) {\n    response.status(400);\n    response.body(\"Invalid path\");\n}","preventionTips":["Never build URLs with ../ relative segments in client code.","Encode and normalize user input before placing it in request paths.","Keep a static handler guard that rejects traversal patterns early with 400.","Pen-test your deployment for traversal and encoded (%2e%2e) variants."],"tags":["security","path-traversal","static-files"],"backgroundTag":"path-traversal-blocked","analyzedSha":"1973e402f5d4c1442ad34a1d38ed0758079f7773","analyzedAt":"2026-09-10T14:38:22.866Z","contentChangedAt":"2026-09-10T14:38:22.866Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}