theonedev/onedev · warning · ExplicitException

Invalid request path

Error message

Invalid request path

What it means

The MarkdownReportPage constructor validates the 'report' page parameter and rejects any value containing ".." with ExplicitException("Invalid request path"). The report name is later joined into a filesystem path, so ".." would enable path traversal to arbitrary files. This is an intentional security rejection of a malformed URL.

Source

Thrown at server-plugin/server-plugin-report-markdown/src/main/java/io/onedev/server/plugin/report/markdown/MarkdownReportPage.java:45

import io.onedev.server.service.BuildService;
import io.onedev.server.service.ProjectService;
import io.onedev.server.web.component.markdown.MarkdownViewer;
import io.onedev.server.web.page.project.builds.detail.BuildDetailPage;

public class MarkdownReportPage extends BuildDetailPage {

	private static final String PARAM_REPORT = "report";
	
	private final String reportName;
	
	private final String filePath;
	
	public MarkdownReportPage(PageParameters params) {
		super(params);
		
		reportName = params.get(PARAM_REPORT).toString();
		if (reportName.contains(".."))
			throw new ExplicitException("Invalid request path");
		
		List<String> pathSegments = new ArrayList<>();
		for (int i=0; i<params.getIndexedCount(); i++) {
			String segment = params.get(i).toString();
			if (segment.contains(".."))
				throw new ExplicitException("Invalid request path");
			if (segment.length() != 0)
				pathSegments.add(segment);
		}
		
		filePath = StringUtils.join(pathSegments, "/");
		
		if (!filePath.endsWith(".md")) {
			RequestCycle.get().scheduleRequestHandlerAfterCurrent(
					new ResourceReferenceRequestHandler(new MarkdownReportDownloadResourceReference(), getPageParameters()));
		}
	}

View on GitHub (pinned to d44925c47c)

Solutions

1. Remove '..' from the report name in the URL.
2. Use the exact report name configured in the Publish Markdown Report step.
3. Regenerate the link from the build page's report listing instead of typing the path.
4. URL-encode the report name when building links programmatically.

Example fix

// before
String link = "/projects/x/builds/5/markdown-reports/../../secret";

// after
String link = "/projects/x/builds/5/markdown-reports/docs";

function validateReportPageParam(reportName) {
  if (typeof reportName !== 'string' || reportName.includes('..')) {
    throw new Error('invalid request path');
  }
}

function isSafeReportName(v) {
  return typeof v === 'string' && !v.includes('..');
}

When it happens

Trigger: Opening a markdown report page URL (/projects/<p>/builds/<n>/markdown-reports/...) whose report name parameter contains '..', e.g. report=../other-report.

Common situations: Hand-written or stale links to report pages; scripts generating report URLs from untrusted input; encoded traversal attempts.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Invalid report name
• Invalid report name
• Invalid request path
• Invalid request path
• Invalid request path

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/3413c2da294932f0. Report an issue: GitHub.