elunez/eladmin · error · BadRequestException

文件格式错误！, 仅支持 gif jpg png jpeg 格式

Error message

文件格式错误！, 仅支持 gif jpg png jpeg 格式

What it means

BadRequestException thrown in UserServiceImpl.updateAvatar when the uploaded avatar file's extension is not one of 'gif jpg png jpeg'. FileUtil.checkSize has already validated size; this check derives the extension from the original filename and rejects anything outside the whitelist. Note the substring-containment check ('gif jpg png jpeg'.contains(ext)), which is loose but functional for typical extensions.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/service/impl/UserServiceImpl.java:225

            // 清除缓存
            flushCache(user.getUsername());
            // 强制退出
            onlineUserService.kickOutForUsername(user.getUsername());
        });
        // 重置密码
        userRepository.resetPwd(ids, pwd);
    }

    @Override
    @Transactional(rollbackFor = Exception.class)
    public Map<String, String> updateAvatar(MultipartFile multipartFile) {
        // 文件大小验证
        FileUtil.checkSize(properties.getAvatarMaxSize(), multipartFile.getSize());
        // 验证文件上传的格式
        String image = "gif jpg png jpeg";
        String fileType = FileUtil.getExtensionName(multipartFile.getOriginalFilename());
        if(fileType != null && !image.contains(fileType)){
            throw new BadRequestException("文件格式错误！, 仅支持 " + image +" 格式");
        }
        User user = userRepository.findByUsername(SecurityUtils.getCurrentUsername());
        String oldPath = user.getAvatarPath();
        File file = FileUtil.upload(multipartFile, properties.getPath().getAvatar());
        user.setAvatarPath(Objects.requireNonNull(file).getPath());
        user.setAvatarName(file.getName());
        userRepository.save(user);
        if (StringUtils.isNotBlank(oldPath)) {
            FileUtil.del(oldPath);
        }
        @NotBlank String username = user.getUsername();
        flushCache(username);
        return new HashMap<String, String>(1) {{
            put("avatar", file.getName());
        }};
    }

    @Override

View on GitHub (pinned to 55fbf70595)

Solutions

1. Convert the image to PNG or JPG before uploading.
2. Take a screenshot/save-as PNG instead of HEIC/WEBP on mobile.
3. If you own the deployment, extend the whitelist string in UserServiceImpl and redeploy — but keep SVG out (XSS risk).

Example fix

// before: rejected upload
avatar.webp → 400 文件格式错误

// after
convert avatar.webp avatar.png; upload avatar.png

const ALLOWED = ['gif','jpg','png','jpeg'];
const ext = file.name.split('.').pop()?.toLowerCase();
if (!ALLOWED.includes(ext)) { alert('仅支持 gif/jpg/png/jpeg'); return; }

const isAllowedAvatar = (f: File) => ['gif','jpg','png','jpeg'].includes(f.name.split('.').pop()?.toLowerCase() ?? '');

catch (BadRequestException e) when (e.getMessage().contains("文件格式错误")) { // prompt conversion to PNG/JPG }

When it happens

Trigger: POST /api/users/updateAvatar with a .webp, .bmp, .svg, .heic or extension-less file.

Common situations: Modern phones defaulting to HEIC/WEBP uploads; users renaming files without changing format assumptions; drag-dropping screenshots saved as unusual formats.

Related errors

• 文件超出规定大小:{maxSize}MB
• 新密码不能与旧密码相同
• {entity} 不存在: {parameter} is {value}
• 没有这个选项
• Database not exist

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/326d4dcc2b6a5da3. Report an issue: GitHub.