jeecgboot/JeecgBoot · warning · JeecgBootBizTipException

原始接口路径不能以 // 或 /\ 开头

Error message

原始接口路径不能以 // 或 /\ 开头

What it means

Thrown when a relative originUrl begins with '//' or '/\'. These prefixes are blocked because '//host' is treated by browsers/proxies as a protocol-relative URL (causing SSRF or off-host routing) and '/\' can be normalized to '\\host' on Windows-style path parsers.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java:269

        }
        String decoded;
        try {
            decoded = java.net.URLDecoder.decode(originUrl, "UTF-8");
            // 二次解码，防止 %252f 这类双重编码绕过
            decoded = java.net.URLDecoder.decode(decoded, "UTF-8");
        } catch (Exception e) {
            throw new JeecgBootBizTipException("原始接口路径包含非法字符");
        }
        //update-begin---author:scott ---date:20260429  for：【issues/9590】微服务nginx部署openApi接口访问不到-----------
        // 微服务部署时，OpenAPI 配置的接口可能位于其他微服务模块（如 erp 7003），允许 originUrl 直接配置完整 http(s) URL
        String lower = decoded.toLowerCase();
        boolean isFullHttpUrl = lower.startsWith("http://") || lower.startsWith("https://");
        if (!isFullHttpUrl) {
            if (!decoded.startsWith("/")) {
                throw new JeecgBootBizTipException("原始接口路径必须以 / 开头，或填写完整的 http(s) URL");
            }
            if (decoded.startsWith("//") || decoded.startsWith("/\\")) {
                throw new JeecgBootBizTipException("原始接口路径不能以 // 或 /\\ 开头");
            }
            if (lower.contains("://") || lower.startsWith("file:") || lower.startsWith("ftp:") || lower.startsWith("gopher:")
                    || lower.startsWith("jar:") || lower.startsWith("netdoc:")) {
                throw new JeecgBootBizTipException("原始接口路径仅支持相对路径或 http(s) 完整URL");
            }
        } else {
            // 即便是完整URL，也禁止其它危险协议（防止 http://x@file:/... 之类的绕过场景）
            String afterScheme = lower.substring(lower.indexOf("://") + 3);
            if (afterScheme.contains("file:") || afterScheme.contains("ftp:") || afterScheme.contains("gopher:")
                    || afterScheme.contains("jar:") || afterScheme.contains("netdoc:")) {
                throw new JeecgBootBizTipException("原始接口路径不允许嵌套 file/ftp/gopher/jar/netdoc 等协议");
            }
        }
        if (decoded.contains("..")) {
            throw new JeecgBootBizTipException("原始接口路径不能包含 ..");
        }
        //update-end---author:scott ---date:20260429  for：【issues/9590】微服务nginx部署openApi接口访问不到-----------
    }

View on GitHub (pinned to 96fb33f5ec)

Solutions

  1. Use a single leading slash for relative paths: '/path', not '//path'.
  2. If you genuinely need to target another host, use the full 'http(s)://host/path' form.
  3. Audit the stored origin_url in the database for any leading '//' introduced by upstream encoding.

Example fix

// before: originUrl = "//erp-service:7003/api"
// after:  originUrl = "http://erp-service:7003/api"
Defensive patterns

Strategy: validation

Validate before calling

// Reject protocol-relative or backslash-relative prefixes
if (originUrl != null && (originUrl.startsWith("//") || originUrl.startsWith("/\\"))) {
    // block submission
}

Prevention

When it happens

Trigger: Configuring origin_url as '//internal-service/x', '/\\evil.com\path', or a value that double-decodes to one of these prefixes.

Common situations: Copy-paste from a protocol-relative URL; attackers testing SSRF; values that survive double-decoding into a leading '//' from '%2f%2f' or '%252f%252f'.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/dbe81eaf06b0cccd. Report an issue: GitHub.