{"record":{"id":"d703ab4ef7198924","repo":"theonedev/onedev","slug":"invalid-report-name-d703ab","errorCode":null,"errorMessage":"Invalid report name","messagePattern":"Invalid report name","errorType":"validation","errorClass":"ExplicitException","httpStatus":400,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/codequality/ProblemReport.java","lineNumber":102,"sourceCode":"\tpublic static List<CodeProblem> getCodeProblems(Build build, String blobPath,\n\t\t\t@Nullable String reportName) {\n\t\tif (reportName != null)\n\t\t\tcheckReportName(reportName);\n\t\tLong projectId = build.getProject().getId();\n\t\tMap<String, Collection<CodeProblem>> problemsMap = OneDev.getInstance(ProjectService.class)\n\t\t\t\t.runOnActiveServer(projectId, new GetCodeProblems(projectId, build.getNumber(),\n\t\t\t\t\t\tblobPath, reportName));\n\t\tList<CodeProblem> problems = new ArrayList<>();\n\t\tfor (var entry: problemsMap.entrySet()) {\n\t\t\tif (SecurityUtils.canAccessReport(build, entry.getKey()))\n\t\t\t\tproblems.addAll(entry.getValue());\n\t\t}\n\t\treturn problems;\n\t}\n\n\tprivate static void checkReportName(String reportName) {\n\t\tif (reportName.contains(\"..\"))\n\t\t\tthrow new ExplicitException(\"Invalid report name\");\n\t}\n\t\n\tpublic void writeTo(File reportDir) {\n\t\tFile dataFile = new File(reportDir, REPORT);\n\t\ttry (var os = new BufferedOutputStream(new FileOutputStream(dataFile), BUFFER_SIZE)) {\n\t\t\tSerializationUtils.serialize(this, os);\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\t\n\tpublic static String getReportLockName(Build build) {\n\t\treturn getReportLockName(build.getProject().getId(), build.getNumber());\n\t}\n\n\tpublic static String getReportLockName(Long projectId, Long buildNumber) {\n\t\treturn ProblemReport.class.getName() + \":\" + projectId + \":\" +  buildNumber;\n\t}","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/codequality/ProblemReport.java#L84-L120","documentation":"ProblemReport.checkReportName rejects report names containing \"..\" to prevent path traversal when the name is resolved under the report directory. The check runs when reading code problem reports (readFrom, getCodeProblems) and throws ExplicitException \"Invalid report name\".","triggerScenarios":"Calling ProblemReport.getCodeProblems(reportName) or readFrom(reportDir, reportName) with a reportName containing \"..\", such as \"../../etc\" or names built from unsanitized CI parameters.","commonSituations":"Problem/issue report names sourced from untrusted build configs or REST input; scripts passing relative paths instead of a bare report name.","solutions":["Strip or reject \"..\" sequences in the report name before calling the API","Pass a single-segment report name and keep directory nesting outside the name","Validate externally supplied report names at the ingestion boundary"],"exampleFix":"// before\nvar problems = report.getCodeProblems(\"../workspace/problems\");\n// after\nvar problems = report.getCodeProblems(\"static-analysis\");","handlingStrategy":"validation","validationCode":"// validate before calling ProblemReport APIs\nif (reportName == null || reportName.contains(\"..\"))\n    throw new IllegalArgumentException(\"problem report name must not contain '..'\");","typeGuard":"function isValidProblemReportName(name) { return typeof name === 'string' && name.length > 0 && !name.includes('..') && !/[/\\\\]/.test(name); }","tryCatchPattern":"try {\n  problems = ProblemReport.getCodeProblems(reportName);\n} catch (ExplicitException e) {\n  if (\"Invalid report name\".equals(e.getMessage())) {\n    problems = ProblemReport.getCodeProblems(sanitizeReportName(reportName));\n  } else throw e;\n}","preventionTips":["Sanitize externally supplied problem report names before use","Reject names containing '..' at the ingestion/plugin boundary","Prefer enumerating available report names via the API instead of constructing them from user input"],"tags":["security","path-traversal","validation","code-quality"],"backgroundTag":"path-traversal-blocked","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}