{"record":{"id":"e29863ad49eee70f","repo":"frohoff/ysoserial","slug":"bad-command-format","errorCode":null,"errorMessage":"Bad command format.","messagePattern":"Bad command format\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/main/java/ysoserial/payloads/Wicket1.java","lineNumber":59,"sourceCode":" * Wicket1 \"write;/tmp;blue lobster\"\n *\n * Result:\n * $ ls -l /tmp/\n * -rw-rw-r-- 1 albino_lobster albino_lobster   12 Jul 25 14:10 upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp\n * $ cat /tmp/upload_3805815b_2d50_4e00_9dae_a854d5a0e614_479431761.tmp\n * blue lobster\n */\n@PayloadTest(harness=\"ysoserial.test.payloads.FileUploadTest\", flaky=\"possible race condition\")\n@Dependencies({\"org.apache.wicket:wicket-util:6.23.0\", \"org.slf4j:slf4j-api:1.6.4\"})\n@Authors({ Authors.JACOBAINES })\npublic class Wicket1 implements ReleaseableObjectPayload<DiskFileItem> {\n\n    public DiskFileItem getObject(String command) throws Exception {\n\n        String[] parts = command.split(\";\");\n\n        if (parts.length != 3) {\n        \tthrow new IllegalArgumentException(\"Bad command format.\");\n        }\n\n        if (\"copyAndDelete\".equals(parts[0])) {\n            return copyAndDelete(parts[1], parts[2]);\n        }\n        else if (\"write\".equals(parts[0])) {\n            return write(parts[1], parts[2].getBytes(\"US-ASCII\"));\n        }\n        else if (\"writeB64\".equals(parts[0]) ) {\n            return write(parts[1], Base64.decodeBase64(parts[2]));\n        }\n        else if (\"writeOld\".equals(parts[0]) ) {\n            return writeOldJRE(parts[1], parts[2].getBytes(\"US-ASCII\"));\n        }\n        else if (\"writeOldB64\".equals(parts[0]) ) {\n            return writeOldJRE(parts[1], Base64.decodeBase64(parts[2]));\n        }\n        throw new IllegalArgumentException(\"Unsupported command \" + command + \" \" + Arrays.toString(parts));","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/frohoff/ysoserial/blob/218bcffcaaa904a4e392f0c15d9e2874533635a3/src/main/java/ysoserial/payloads/Wicket1.java#L41-L77","documentation":"ysoserial's Wicket1 payload generator throws this IllegalArgumentException from getObject() when the command string does not split into exactly 3 ';'-separated parts. The Wicket1 DiskFileItem gadget requires a command of the form '<operation>;<arg1>;<arg2>', so any other shape is rejected before dispatch.","triggerScenarios":"Calling new Wicket1().getObject(command) with a command that yields parts.length != 3 after command.split(\";\"), e.g. 'write' alone, 'copyAndDelete;file' (only 2 parts), or a string containing no semicolons at all.","commonSituations":"Users forget the semicolon-delimited format when configuring the payload, pass a path containing no separator but omit the second argument, or copy a command from another ysoserial payload with a different argument format.","solutions":["Supply exactly three semicolon-separated fields: operation, arg1, arg2 (e.g. 'copyAndDelete;/tmp/source;/tmp/dest' or 'write;/tmp/target;content').","Check the command for stray/missing semicolons; escape-free ';' characters must number exactly two.","Pick a supported operation name as parts[0]: 'copyAndDelete', 'write', 'writeOld', or 'writeOldB64' (see error 21 for unknown ops)."],"exampleFix":"// before\nString command = \"write /tmp/x hello\";\nDiskFileItem item = new Wicket1().getObject(command);\n// after\nString command = \"write;/tmp/x;hello\";\nDiskFileItem item = new Wicket1().getObject(command);","handlingStrategy":"validation","validationCode":"public static void validateWicket1Command(String command) {\n    if (command == null || command.split(\";\", -1).length != 3) {\n        throw new IllegalArgumentException(\"Wicket1 command must be 'op;arg1;arg2' (exactly 3 parts): \" + command);\n    }\n}","typeGuard":"public static boolean isValidWicket1Command(String command) {\n    return command != null && command.split(\";\", -1).length == 3;\n}","tryCatchPattern":"try {\n    DiskFileItem item = new Wicket1().getObject(command);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Bad command format\")) {\n        System.err.println(\"Command must have exactly 3 ';'-separated parts: 'op;arg1;arg2'\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Always format Wicket1 commands as 'operation;arg1;arg2' with exactly two semicolons.","Write a small helper that builds the command string from an op enum plus two args instead of hand-concatenating.","Trim user-supplied input and reject null/empty commands before calling getObject()."],"tags":["java","argument-format","payload-generation"],"backgroundTag":"invalid-argument-format","analyzedSha":"218bcffcaaa904a4e392f0c15d9e2874533635a3","analyzedAt":"2026-09-12T01:53:58.488Z","contentChangedAt":"2026-09-12T01:53:58.488Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}