{"record":{"id":"c51d2c1ffd10f50f","repo":"theonedev/onedev","slug":"markdown-report-name-has-to-be-specified","errorCode":null,"errorMessage":"Markdown report name has to be specified","messagePattern":"Markdown report name has to be specified","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-report-markdown/src/main/java/io/onedev/server/plugin/report/markdown/MarkdownReportDownloadResource.java","lineNumber":59,"sourceCode":"\t\tProject project = OneDev.getInstance(ProjectService.class).findByPath(projectPath);\n\t\t\n\t\tLong buildNumber = params.get(PARAM_BUILD).toOptionalLong();\n\t\t\n\t\tif (buildNumber == null)\n\t\t\tthrow new IllegalArgumentException(\"build number has to be specified\");\n\t\t\n\t\tBuild build = OneDev.getInstance(BuildService.class).find(project, buildNumber);\n\n\t\tif (build == null) {\n\t\t\tString message = String.format(\"Unable to find build (project: %s, build number: %d)\", \n\t\t\t\t\tproject.getPath(), buildNumber);\n\t\t\tthrow new EntityNotFoundException(message);\n\t\t}\n\t\t\n\t\tString reportName = params.get(PARAM_REPORT).toOptionalString();\n\t\t\n\t\tif (reportName == null)\n\t\t\tthrow new IllegalArgumentException(\"Markdown report name has to be specified\");\n\t\tif (reportName.contains(\"..\"))\n\t\t\tthrow new ExplicitException(\"Invalid request path\");\n\t\t\n\t\tif (!SecurityUtils.canAccessReport(build, reportName))\n\t\t\tthrow new UnauthorizedException();\n\t\t\t\n\t\tList<String> pathSegments = new ArrayList<>();\n\t\tfor (int i = 0; i < params.getIndexedCount(); i++) {\n\t\t\tString pathSegment = params.get(i).toString();\n\t\t\tif (pathSegment.contains(\"..\"))\n\t\t\t\tthrow new ExplicitException(\"Invalid request path\");\n\t\t\tif (pathSegment.length() != 0)\n\t\t\t\tpathSegments.add(pathSegment);\n\t\t}\n\t\t\n\t\tString markdownPath = Joiner.on(\"/\").join(pathSegments);\n\t\t\n\t\tFile buildDir = build.getDir();","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-report-markdown/src/main/java/io/onedev/server/plugin/report/markdown/MarkdownReportDownloadResource.java#L41-L77","documentation":"MarkdownReportDownloadResource requires the report name parameter; when params.get(PARAM_REPORT).toOptionalString() returns null it throws IllegalArgumentException 'Markdown report name has to be specified'. A subsequent '..' check throws 'Invalid request path' and access is gated by SecurityUtils.canAccessReport.","triggerScenarios":"GET on the markdown report download resource with no report parameter in the URL.","commonSituations":"URL builders omitting the report name; links to the report collection root rather than a named report; template variable left unset.","solutions":["Add the report name to the request URL (the name under which the report was published)","Ensure the pipeline actually publishes the markdown report and use its exact name","Fix the URL template so the report variable is filled"],"exampleFix":"// before\nGET /~resources/markdown-report/proj/50/report/\n// after\nGET /~resources/markdown-report/proj/50/report/test-summary","handlingStrategy":"validation","validationCode":"const reportName = params.get('report');\nif (reportName == null || reportName.length === 0) throw new Error('Markdown report name has to be specified');","typeGuard":"function hasReportName(params) { const r = params.get('report'); return typeof r === 'string' && r.length > 0 && !r.includes('..'); }","tryCatchPattern":"try { fetch(url); } catch (IllegalArgumentException | ExplicitException e) { // fill report param and retry }","preventionTips":["Always include the published report's exact name in URLs","Validate report names (non-empty, no '..') before requesting","Check SecurityUtils.canAccessReport expectations when sharing links across users"],"tags":["rest","missing-argument","report"],"backgroundTag":"missing-required-argument","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}