jeecgboot/JeecgBoot · warning · JeecgBootBizTipException

原始接口路径不能为空

Error message

原始接口路径不能为空

What it means

OpenApiController.validOriginUrl() validates the originUrl of an OpenAPI definition before proxying. The very first check rejects an empty/null originUrl with JeecgBootBizTipException. Subsequent checks (URL decode, scheme allow-list, '..' / '//' rejection) only run if a value is present, so this error specifically means the field was blank.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/controller/OpenApiController.java:250

     * @param USERNAME
     * @param PASSWORD
     * @return
     */
    private String getToken(String USERNAME, String PASSWORD) {
        String token = JwtUtil.sign(USERNAME, PASSWORD, CommonConstant.CLIENT_TYPE_PC);
        redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + token, token);
        redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + token, 60);
        return token;
    }

    /**
     * 校验原始接口路径是否合法：
     *  - 相对路径：必须以 / 开头，不允许 // 和 .. 防止路径穿越
     *  - 完整URL：仅允许 http/https 协议，禁止 file/ftp/gopher/jar/netdoc 等其它协议（用于微服务模式跨模块调用）
     */
    private void validOriginUrl(String originUrl) {
        if (oConvertUtils.isEmpty(originUrl)) {
            throw new JeecgBootBizTipException("原始接口路径不能为空");
        }
        String decoded;
        try {
            decoded = java.net.URLDecoder.decode(originUrl, "UTF-8");
            // 二次解码，防止 %252f 这类双重编码绕过
            decoded = java.net.URLDecoder.decode(decoded, "UTF-8");
        } catch (Exception e) {
            throw new JeecgBootBizTipException("原始接口路径包含非法字符");
        }
        //update-begin---author:scott ---date:20260429  for：【issues/9590】微服务nginx部署openApi接口访问不到-----------
        // 微服务部署时，OpenAPI 配置的接口可能位于其他微服务模块（如 erp 7003），允许 originUrl 直接配置完整 http(s) URL
        String lower = decoded.toLowerCase();
        boolean isFullHttpUrl = lower.startsWith("http://") || lower.startsWith("https://");
        if (!isFullHttpUrl) {
            if (!decoded.startsWith("/")) {
                throw new JeecgBootBizTipException("原始接口路径必须以 / 开头，或填写完整的 http(s) URL");
            }
            if (decoded.startsWith("//") || decoded.startsWith("/\\")) {

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Provide a non-empty originUrl: a relative path starting with '/' (e.g. '/jeecg-boot/api/foo') or a full http(s) URL for microservice mode.
2. Validate the field on the admin form (required) before submit.
3. For imports, ensure every row has a non-blank originUrl.

if (oConvertUtils.isEmpty(originUrl)) {
    return Result.error("原始接口路径不能为空");
}
// then proceed to validOriginUrl only when non-empty

// validOriginUrl throws JeecgBootBizTipException; let the global handler map it to a 400,
// but validate on the form first for a better UX.

When it happens

Trigger: Creating or updating an OpenAPI record (open_api table) with a null/empty originUrl; a form submission or data import that omits the path.

Common situations: Admin form submitted without filling the path; a bulk import/migration row missing originUrl; a script creating open_api rows without the column.

Related errors

• 非法存储路径，路径包含遍历字符: {storePath}
• 请注意，值可能存在SQL注入风险!--->{value}
• 请注意，SQL中不允许含注释，有安全风险！
• 请注意，值可能存在SQL注入风险---> \*.*\
• 表名不合法，存在SQL注入风险!--->{table}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/f8150d9149834368. Report an issue: GitHub.