jeecgboot/JeecgBoot · error · JeecgBootException

${e.getMessage()}

Error message

${e.getMessage()}

What it means

In the comment-attachment upload path, SsrfFileTypeFilter.checkUploadFileType validates the file extension/type and the bizPath before storage. Any failure is re-wrapped as JeecgBootException(e); because JeecgBootException(Throwable) delegates getMessage() to the cause, the surfaced message is the filter's own message (e.g. '上传失败，存在非法文件类型：xxx', '上传业务路径包含非法字符！', '上传业务路径深度超出限制！').

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysCommentServiceImpl.java:136

    }

    @Transactional(rollbackFor = Exception.class)
    @Override
    public void saveOneFileComment(HttpServletRequest request) {
        String existFileId = request.getParameter("fileId");
        if(oConvertUtils.isEmpty(existFileId)){
            String savePath = "";
            // 获取业务路径
            String bizPath = request.getParameter("biz");
            // 获取上传文件对象
            MultipartHttpServletRequest multipartRequest = (MultipartHttpServletRequest) request;
            MultipartFile file = multipartRequest.getFile("file");

            // 文件安全校验，防止上传漏洞文件
            try {
                SsrfFileTypeFilter.checkUploadFileType(file, bizPath);
            } catch (Exception e) {
                throw new JeecgBootException(e);
            }

            if (oConvertUtils.isEmpty(bizPath)) {
                bizPath = CommonConstant.UPLOAD_TYPE_OSS.equals(uploadType) ? "upload" : "";
            }
            if (CommonConstant.UPLOAD_TYPE_LOCAL.equals(uploadType)) {
                savePath = this.uploadLocal(file, bizPath);
            } else {
                savePath = CommonUtils.upload(file, bizPath, uploadType);
            }

            String orgName = file.getOriginalFilename();
            // 获取文件名
            orgName = CommonUtils.getFileName(orgName);
            //文件大小
            long size = file.getSize();
            //文件类型
            String type = orgName.substring(orgName.lastIndexOf("."), orgName.length());

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Read the wrapped message to identify which specific check failed (file type vs path char vs depth).
2. Use an allowed file extension; if a legitimate type is blocked, extend the allowlist in the jeecg config.
3. Sanitize bizPath: no ../, no illegal characters, within the configured depth limit.
4. Never pass raw user input as bizPath.

Example fix

// before
String biz = request.getParameter("biz"); // may contain ../
SsrfFileTypeFilter.checkUploadFileType(file, biz); // throws
// after
String biz = sanitizeBizPath(request.getParameter("biz"));
// sanitizeBizPath strips ../, leading slashes, and enforces a fixed allowlist of folders
SsrfFileTypeFilter.checkUploadFileType(file, biz);

// Validate extension and bizPath against the same rules the filter enforces, BEFORE uploading.
String ext = FilenameUtils.getExtension(file.getOriginalFilename()).toLowerCase();
if (!ALLOWED_EXTENSIONS.contains(ext)) {
    return Result.error("不支持的文件类型: " + ext);
}
String bizPath = sanitizeBizPath(request.getParameter("biz")); // no ../, no illegal chars, depth-checked
if (bizPath == null) {
    return Result.error("业务路径非法");
}

public boolean isUploadAllowed(MultipartFile f, String bizPath) {
    try {
        SsrfFileTypeFilter.checkUploadFileType(f, bizPath);
        return true;
    } catch (Exception e) { return false; }
}

try {
    sysCommentService.uploadCommentFile(request, ...);
} catch (JeecgBootException e) {
    // e.getMessage() is the filter's specific reason
    return Result.error("文件上传被拒: " + e.getMessage());
}

When it happens

Trigger: Uploading a disallowed extension (e.g. .exe, .jsp, .sh, .svg); a bizPath containing traversal/illegal characters; a bizPath whose depth exceeds the configured limit; bizPath null where a value is required.

Common situations: Restrictive extension allowlist blocking a legitimate business file type; client sending a crafted or user-controlled bizPath; missing/typo bizPath from the frontend; SSRF guard rejecting a host in a URL-based path.

Related errors

• Illegal access to path outside of base directory.
• 非法业务路径，禁止访问上传目录之外的路径: ${bizPath}
• 非法业务路径，禁止访问上传目录之外的路径: ${bizPath}
• 非法存储路径，路径包含遍历字符: {storePath}
• 存储路径校验失败: {storePath}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/7a337dd76b6c36a1. Report an issue: GitHub.