{"record":{"id":"c4712db789212124","repo":"theonedev/onedev","slug":"invalid-artifact-request-path","errorCode":null,"errorMessage":"Invalid artifact request path","messagePattern":"Invalid artifact request path","errorType":"http","errorClass":"ExplicitException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/ai/TodResource.java","lineNumber":929,"sourceCode":"    @Path(\"/get-build-unit-test-report\")\n    @GET\n    public Response getBuildUnitTestReport(\n                @QueryParam(\"currentProject\") @NotNull String currentProjectPath,\n                @QueryParam(\"reference\") @NotNull String buildReference,\n                @QueryParam(\"reportName\") @NotNull String reportName,\n                @QueryParam(\"artifactPath\") String artifactPath) {\n        if (SecurityUtils.getUser() == null)\n            throw new UnauthenticatedException();\n\n        var currentProject = getProject(currentProjectPath);\n        var build = getBuild(currentProject, buildReference);\n\n        if (!SecurityUtils.canAccessReport(build, reportName))\n            throw new UnauthorizedException(\"No permission to access report: \" + reportName);\n        if (artifactPath != null) {\n            if (reportName.contains(\"..\") || artifactPath.contains(\"..\")\n                    || !artifactPath.startsWith(UnitTestReport.ARTIFACTS + \"/\")) {\n                throw new ExplicitException(\"Invalid artifact request path\");\n            }\n            String mediaType;\n            try {\n                mediaType = MimeUtils.sanitize(Files.probeContentType(Paths.get(artifactPath)));\n            } catch (IOException e) {\n                throw new RuntimeException(e);\n            }\n            String fileName = StringUtils.substringAfterLast(artifactPath, \"/\");\n            var projectId = build.getProject().getId();\n            var buildNumber = build.getNumber();\n            StreamingOutput streamingOutput = os -> UnitTestReport.downloadArtifact(\n                    projectId, buildNumber, reportName, artifactPath, os);\n            return Response.ok(streamingOutput, mediaType)\n                    .header(\"X-Content-Type-Options\", \"nosniff\")\n                    .header(\"Content-Disposition\", \"attachment; filename=\\\"\"\n                            + URLEncoder.encode(fileName, StandardCharsets.UTF_8) + \"\\\"\")\n                    .build();\n        } else {","sourceCodeStart":911,"sourceCodeEnd":947,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/ai/TodResource.java#L911-L947","documentation":"Guard in TodResource's build-report/artifact endpoints: the supplied artifactPath does not conform to the expected format, so the artifact request cannot be resolved against the build's published artifacts.","triggerScenarios":"Thrown at server-core/src/main/java/io/onedev/server/ai/TodResource.java:929 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the artifact path exactly as reported by the build's publish step.","Omit artifactPath to get the root listing, or pass a valid relative path within the artifacts directory."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}