{"record":{"id":"f3cae6555190111c","repo":"frohoff/ysoserial","slug":"unsupported-command-command-parts","errorCode":null,"errorMessage":"Unsupported command ${command} ${parts}","messagePattern":"Unsupported command (.+?) (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/main/java/ysoserial/payloads/FileUpload1.java","lineNumber":71,"sourceCode":"        String[] parts = command.split(\";\");\n\n        if ( parts.length == 3 && \"copyAndDelete\".equals(parts[ 0 ]) ) {\n            return copyAndDelete(parts[ 1 ], parts[ 2 ]);\n        }\n        else if ( parts.length == 3 && \"write\".equals(parts[ 0 ]) ) {\n            return write(parts[ 1 ], parts[ 2 ].getBytes(\"US-ASCII\"));\n        }\n        else if ( parts.length == 3 && \"writeB64\".equals(parts[ 0 ]) ) {\n            return write(parts[ 1 ], Base64.decodeBase64(parts[ 2 ]));\n        }\n        else if ( parts.length == 3 && \"writeOld\".equals(parts[ 0 ]) ) {\n            return writePre131(parts[ 1 ], parts[ 2 ].getBytes(\"US-ASCII\"));\n        }\n        else if ( parts.length == 3 && \"writeOldB64\".equals(parts[ 0 ]) ) {\n            return writePre131(parts[ 1 ], Base64.decodeBase64(parts[ 2 ]));\n        }\n        else {\n            throw new IllegalArgumentException(\"Unsupported command \" + command + \" \" + Arrays.toString(parts));\n        }\n    }\n\n\n    public void release ( DiskFileItem obj ) throws Exception {\n        // otherwise the finalizer deletes the file\n        DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);\n        Reflections.setFieldValue(obj, \"dfos\", dfos);\n    }\n\n    private static DiskFileItem copyAndDelete ( String copyAndDelete, String copyTo ) throws IOException, Exception {\n        return makePayload(0, copyTo, copyAndDelete, new byte[1]);\n    }\n\n\n    // writes data to a random filename (update_<per JVM random UUID>_<COUNTER>.tmp)\n    private static DiskFileItem write ( String dir, byte[] data ) throws IOException, Exception {\n        return makePayload(data.length + 1, dir, dir + \"/whatever\", data);","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/frohoff/ysoserial/blob/218bcffcaaa904a4e392f0c15d9e2874533635a3/src/main/java/ysoserial/payloads/FileUpload1.java#L53-L89","documentation":"FileUpload1 payload supports a fixed set of sub-commands (store, write, writeB64/writeOldB64 variants) encoded in parts[0]. getObject() throws this IllegalArgumentException when the command string does not match any supported sub-command or has the wrong number of parts.","triggerScenarios":"Calling FileUpload1.getObject(command) where parts[0] is not one of the supported command names, or the split count doesn't match any accepted branch (parts.length values other than the handled 2/3-element forms).","commonSituations":"Copy-pasting a command string from a different payload; misspelling 'writeOldB64' or 'store'; passing a plain filename without a sub-command prefix.","solutions":["Prefix the command with a supported sub-command, e.g. 'writeOldB64;<filename>;<base64>'","Check FileUpload1 source for the exact accepted command names and required part counts","Base64-encode content when using the *B64 variants instead of passing raw bytes"],"exampleFix":"// before\nnew FileUpload1().getObject(\"/tmp/x.txt;hello\");\n// after\nnew FileUpload1().getObject(\"writeOldB64;/tmp/x.txt;aGVsbG8=\");","handlingStrategy":"validation","validationCode":"Set<String> cmds = Set.of(\"store\",\"write\",\"writeB64\",\"writeOldB64\"); if (!cmds.contains(command.split(\";\")[0])) throw new IllegalArgumentException(\"unsupported sub-command\");","typeGuard":null,"tryCatchPattern":"try { obj = new FileUpload1().getObject(cmd); } catch (IllegalArgumentException e) { printAcceptedCommands(); }","preventionTips":["Prefix every command with a valid sub-command","Match part count to the chosen sub-command","Copy command formats from the payload source, not memory"],"tags":["argument-parsing","ysoserial","fileupload"],"backgroundTag":"invalid-argument-format","analyzedSha":"218bcffcaaa904a4e392f0c15d9e2874533635a3","analyzedAt":"2026-09-12T01:53:58.488Z","contentChangedAt":"2026-09-12T01:53:58.488Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}