theonedev/onedev · error · ExplicitException

Invalid request path

Error message

Invalid request path

What it means

ArtifactResource serves build artifact files. While reconstructing the artifact path from the indexed URL path segments, it throws ExplicitException 'Invalid request path' if any segment contains '..'. This is a path-traversal guard preventing clients from escaping the artifact directory via relative path segments.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/resource/ArtifactResource.java:51

	private static final long serialVersionUID = 1L;

	private static final String PARAM_PROJECT = "project";

	private static final String PARAM_BUILD = "build";

	@Override
	protected ResourceResponse newResourceResponse(Attributes attributes) {
		PageParameters params = attributes.getParameters();

		Long projectId = params.get(PARAM_PROJECT).toLong();
		Long buildNumber = params.get(PARAM_BUILD).toLong();
		
		List<String> pathSegments = new ArrayList<>();

		for (int i = 0; i < params.getIndexedCount(); i++) {
			String pathSegment = params.get(i).toString();
			if (pathSegment.contains(".."))
				throw new ExplicitException("Invalid request path");
			if (pathSegment.length() != 0)
				pathSegments.add(pathSegment);
		}
		
		if (pathSegments.isEmpty())
			throw new ExplicitException("Artifact path has to be specified");
		
		String artifactPath = Joiner.on("/").join(pathSegments);
		
		FileInfo fileInfo = null;
		if (!SecurityUtils.isSystem()) {
			Project project = OneDev.getInstance(ProjectService.class).load(projectId);
			
			Build build = OneDev.getInstance(BuildService.class).find(project, buildNumber);

			if (build == null) {
				String message = String.format("Unable to find build (project: %s, build number: %d)", 
						project.getPath(), buildNumber);

View on GitHub (pinned to d44925c47c)

Solutions

1. Remove '..' segments from the artifact URL path and reference the artifact with its full literal path from the build root
2. If building the URL from a relative path, normalize it against the artifact root in your script before requesting
3. If a legitimate artifact file name contains '..', rename the file in the build script; such names cannot be fetched via this resource

Example fix

// before
GET /~resources/artifact?project=1&build=5&path=dist/../secrets
// after
GET /~resources/artifact?project=1&build=5&path=dist/app.jar

if (artifactPath.split('/').some(seg => seg === '..' || seg.includes('..'))) throw new Error('artifact path must not contain .. segments: ' + artifactPath);

function isSafeArtifactPath(p) { return typeof p === 'string' && p.length > 0 && !p.includes('..'); }

When it happens

Trigger: Requesting an artifact URL whose path contains a '..' segment anywhere, e.g. /~resources/artifact/1/5/../../etc/passwd, or a file name that literally includes '..'.

Common situations: Naive scripts joining paths with .. to shorten the artifact path; path templates where a variable resolves to '..'; attempted directory traversal (often by scanners).

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Invalid report name
• Invalid report name
• Invalid artifact path
• Invalid request path
• Invalid request path

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/0c43ac39670f4bfe. Report an issue: GitHub.