perwendel/spark · warning
Bad request
Error message
Bad request
What it means
StaticFilesConfiguration.consume catches DirectoryTraversalDetection (a path-traversal attempt detected in the request path), sets HTTP 400, writes the literal body 'Bad request' and logs a warning. Clients see 'Bad request' when spark blocks an apparent ../ traversal against static resources.
Solutions
- Do not serve paths containing traversal segments — fix the client/URL to reference resources within the static root.
- Catch DirectoryTraversalDetection at your own layer if you want a custom 4xx response instead of the default 'Bad request' body.
- Audit proxies/templates so ../ sequences never reach the static handler.
- Register static resources with the correct root so legitimate deep paths are not misdetected.
Example fix
// before curl http://host/scripts/../../etc/passwd // after curl http://host/scripts/app.js // path stays inside the static root
Defensive patterns
Strategy: try-catch
Validate before calling
boolean isTraversal(String path) {
String norm = path.replace("\\", "/");
return norm.contains("../") || norm.contains("..%2F") || norm.contains("%2e%2e");
} Try / catch
// DirectoryTraversalDetection is caught internally by consume(); to customize:
try {
boolean served = staticFiles.consume(request, response);
} catch (Exception e) {
response.status(400);
response.body("Invalid path");
} Prevention
- Never build URLs with ../ relative segments in client code.
- Encode and normalize user input before placing it in request paths.
- Keep a static handler guard that rejects traversal patterns early with 400.
- Pen-test your deployment for traversal and encoded (%2e%2e) variants.
When it happens
Trigger: Requesting a static resource whose normalized path escapes the configured static folder, e.g. GET /../../etc/passwd or encoded variants (%2e%2e%2f) that resolve outside the static files root.
Common situations: Security scanners or curl tests probing for directory traversal; misconfigured reverse proxies forwarding '..' segments; clients with relative links containing ../ generated by buggy template code.
Understand the failure class
Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.
Related errors
- classpath
- external
- Static file location has already been set
- External static file location has already been set
AI-assisted analysis of perwendel/spark@1973e402f5 (2026-09-10).
Data as JSON: /api/errors/b9e5a3dae3be0a57.
Report an issue: GitHub.
Appendix: source
Thrown at src/main/java/spark/staticfiles/StaticFilesConfiguration.java:76
/**
* Attempt consuming using either static resource handlers or jar resource handlers
*
* @param httpRequest The HTTP servlet request.
* @param httpResponse The HTTP servlet response.
* @return true if consumed, false otherwise.
* @throws IOException in case of IO error.
*/
public boolean consume(HttpServletRequest httpRequest,
HttpServletResponse httpResponse) throws IOException {
try {
if (consumeWithFileResourceHandlers(httpRequest, httpResponse)) {
return true;
}
} catch (DirectoryTraversal.DirectoryTraversalDetection directoryTraversalDetection) {
httpResponse.setStatus(400);
httpResponse.getWriter().write("Bad request");
httpResponse.getWriter().flush();
LOG.warn(directoryTraversalDetection.getMessage() + " directory traversal detection for path: "
+ httpRequest.getPathInfo());
}
return false;
}
private boolean consumeWithFileResourceHandlers(HttpServletRequest httpRequest,
HttpServletResponse httpResponse) throws IOException {
if (staticResourceHandlers != null) {
for (AbstractResourceHandler staticResourceHandler : staticResourceHandlers) {
AbstractFileResolvingResource resource = staticResourceHandler.getResource(httpRequest);
if (resource != null && resource.isReadable()) {
View on GitHub (pinned to 1973e402f5)