{"record":{"id":"cb3257eec3cb9c21","repo":"theonedev/onedev","slug":"invalid-request-path-cb3257","errorCode":null,"errorMessage":"Invalid request path","messagePattern":"Invalid request path","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"warning","filePath":"server-core/src/main/java/io/onedev/server/web/page/project/commits/CommitDetailPage.java","lineNumber":179,"sourceCode":"\t\t\t\t@Override\n\t\t\t\tprotected Collection<CodeComment> load() {\n\t\t\t\t\tCodeCommentService manager = OneDev.getInstance(CodeCommentService.class);\n\t\t\t\t\treturn manager.query(projectModel.getObject(), getCompareWith(), resolvedRevision);\n\t\t\t\t}\n\n\t\t\t};\n\n\tprivate WebMarkupContainer refsContainer;\n\t\n\tprivate WebMarkupContainer revisionDiff;\n\t\n\tpublic CommitDetailPage(PageParameters params) {\n\t\tsuper(params);\n\n\t\tList<String> revisionSegments = new ArrayList<>();\n\t\tString segment = params.get(PARAM_COMMIT).toString();\n\t\tif (segment.contains(\"..\"))\n\t\t\tthrow new ExplicitException(_T(\"Invalid request path\"));\n\t\tif (segment.length() != 0)\n\t\t\trevisionSegments.add(segment);\n\t\tfor (int i=0; i<params.getIndexedCount(); i++) {\n\t\t\tsegment = params.get(i).toString();\n\t\t\tif (segment.contains(\"..\"))\n\t\t\t\tthrow new ExplicitException(_T(\"Invalid request path\"));\n\t\t\tif (segment.length() != 0)\n\t\t\t\trevisionSegments.add(segment);\n\t\t}\n\n\t\tif (revisionSegments.isEmpty())\n\t\t\tthrow new RestartResponseException(ProjectCommitsPage.class, ProjectCommitsPage.paramsOf(getProject()));\n\t\t\n\t\tstate = new State();\n\t\tstate.revision = Joiner.on(\"/\").join(revisionSegments);\n\t\t\n\t\tstate.compareWith = params.get(PARAM_COMPARE_WITH).toString();\n\t\tstate.whitespaceOption = WhitespaceOption.ofName(","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/page/project/commits/CommitDetailPage.java#L161-L197","documentation":"CommitDetailPage parses the commit/revision segment (and indexed extra segments) from the URL into a revision range list. Because a range like 'a..b' is not a single commit, any segment containing '..' is rejected up front with ExplicitException('Invalid request path') to avoid ambiguity and path/range injection in commit URLs.","triggerScenarios":"Opening a commit detail URL whose PARAM_COMMIT segment contains '..' (e.g. /~commits/abc123..def456) instead of the compare page.","commonSituations":"Pasting a git range ('a..b') into a commit URL; a tool generating links with raw revision expressions; link built from user input containing dots.","solutions":["Use the compare page (RevisionComparePage / project 'Compare' URL) for ranges instead of the commit detail URL.","Open a single commit hash in the commit detail URL: /~commits/<hash>.","In integrations, validate the revision segment contains no '..' before building the URL."],"exampleFix":"// before\nGET /projects/app/~commits/main..feature  // range in commit URL\n// after\nGET /projects/app/~compare/main...feature","handlingStrategy":"validation","validationCode":"if (revision == null || revision.contains(\"..\")) {\n    throw new IllegalArgumentException(\"Use compare page for ranges; commit URL accepts a single revision\");\n}","typeGuard":"static boolean isSingleRevision(String s) { return s != null && !s.contains(\"..\") && !s.isBlank(); }","tryCatchPattern":"try {\n    // navigate to commit detail\n} catch (ExplicitException e) {\n    // fall back to compare page for ranges\n}","preventionTips":["Send revision ranges ('a..b') to the compare page, not the commit page.","Escape revision strings when interpolating them into URLs.","Prefer full commit hashes for commit detail links."],"tags":["onedev","git","url","validation"],"backgroundTag":"invalid-url-format","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}