jeecgboot/JeecgBoot · error · JeecgBootBizTipException

原始接口路径不能包含 ..

Error message

原始接口路径不能包含 ..

What it means

Thrown when the decoded originUrl contains '..' anywhere. This is a path-traversal guard applied to both relative and full-URL forms, preventing escalation out of the intended path root (e.g. '/public/../private/secret').

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java:284

                throw new JeecgBootBizTipException("原始接口路径必须以 / 开头，或填写完整的 http(s) URL");
            }
            if (decoded.startsWith("//") || decoded.startsWith("/\\")) {
                throw new JeecgBootBizTipException("原始接口路径不能以 // 或 /\\ 开头");
            }
            if (lower.contains("://") || lower.startsWith("file:") || lower.startsWith("ftp:") || lower.startsWith("gopher:")
                    || lower.startsWith("jar:") || lower.startsWith("netdoc:")) {
                throw new JeecgBootBizTipException("原始接口路径仅支持相对路径或 http(s) 完整URL");
            }
        } else {
            // 即便是完整URL，也禁止其它危险协议（防止 http://x@file:/... 之类的绕过场景）
            String afterScheme = lower.substring(lower.indexOf("://") + 3);
            if (afterScheme.contains("file:") || afterScheme.contains("ftp:") || afterScheme.contains("gopher:")
                    || afterScheme.contains("jar:") || afterScheme.contains("netdoc:")) {
                throw new JeecgBootBizTipException("原始接口路径不允许嵌套 file/ftp/gopher/jar/netdoc 等协议");
            }
        }
        if (decoded.contains("..")) {
            throw new JeecgBootBizTipException("原始接口路径不能包含 ..");
        }
        //update-end---author:scott ---date:20260429  for：【issues/9590】微服务nginx部署openApi接口访问不到-----------
    }

    @GetMapping("/json")
    public SwaggerModel swaggerModel() {

        SwaggerModel swaggerModel = new SwaggerModel();
        swaggerModel.setSwagger("2.0");
        swaggerModel.setInfo(swaggerInfo());
        swaggerModel.setHost("jeecg.com");
        swaggerModel.setBasePath("/jeecg-boot");
        swaggerModel.setSchemes(Lists.newArrayList("http", "https"));

        SwaggerTag swaggerTag = new SwaggerTag();
        swaggerTag.setName("openapi");
        swaggerModel.setTags(Lists.newArrayList(swaggerTag));

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Remove all '..' segments from origin_url; resolve the canonical absolute path instead.
2. If '..' appears inside an innocent token (e.g. a version folder 'v2..1'), rename the token to avoid the substring.
3. Normalize the path server-side with Paths.get(x).normalize() before display so users see the clean form.

Example fix

// before: originUrl = "/web/../sys/api"
// after:  originUrl = "/sys/api"

// Reject any '..' substring before submitting
if (originUrl != null && originUrl.contains("..")) {
    // reject; the server's substring check is naive and will also catch '..' inside tokens
}

When it happens

Trigger: origin_url containing literal '..' such as '/app/../etc/passwd', '/a/..b', or values that decode from '%2e%2e' / '%252e%252e'.

Common situations: Path-traversal test payloads; generated URLs that include '..' for parent-folder references; note the check is a naive substring match, so a legitimate path segment like '/my..app/x' would also be rejected.

Related errors

• 原始接口路径不能以 // 或 /\ 开头
• 原始接口路径仅支持相对路径或 http(s) 完整URL
• 原始接口路径不允许嵌套 file/ftp/gopher/jar/netdoc 等协议
• Illegal access to path outside of base directory.
• 非法业务路径，禁止访问上传目录之外的路径: ${bizPath}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/9561a416451d16f2. Report an issue: GitHub.