theonedev/onedev · warning · ExplicitException

Invalid request path

Error message

Invalid request path

What it means

ProjectBlobPage builds the blob path from indexed URL parameters; any segment containing '..' is rejected with an ExplicitException to prevent path traversal in repository blob URLs. The message is a plain (unlocalized) ExplicitException.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/project/blob/ProjectBlobPage.java:219

	
	private State state;
	
	private ObjectId resolvedRevision;
	
	private Component revisionIndexing;
	
	private WebMarkupContainer searchResult;
	
	private AbstractPostAjaxBehavior ajaxBehavior;
	
	public ProjectBlobPage(PageParameters params) {
		super(params);
		
		List<String> revisionAndPathSegments = new ArrayList<>();
		for (int i=0; i<params.getIndexedCount(); i++) {
			String segment = params.get(i).toString();
			if (segment.contains(".."))
				throw new ExplicitException("Invalid request path");
			if (segment.length() != 0)
				revisionAndPathSegments.add(segment);
		}

		BlobIdent blobIdent = new BlobIdent(getProject(), revisionAndPathSegments); 
		state = new State(blobIdent);

		String modeStr = params.get(PARAM_MODE).toString();
		if (modeStr != null)
			state.mode = Mode.valueOf(modeStr.toUpperCase());
		
		String viewPlain = params.get(PARAM_VIEW_PLAIN).toString();
		state.viewPlain = "true".equals(viewPlain);
		
		state.urlBeforeEdit = params.get(PARAM_URL_BEFORE_EDIT).toString();
		state.urlAfterEdit = params.get(PARAM_URL_AFTER_EDIT).toString();

		if (state.blobIdent.revision != null)

View on GitHub (pinned to d44925c47c)

Solutions

1. Remove '..' segments from the URL and use the normalized repository path
2. Navigate via the repository file browser instead of hand-building blob URLs
3. URL-encode or resolve relative paths client-side before constructing the link

Example fix

// before
/projects/demo/blob/main/docs/../src/App.java
// after
/projects/demo/blob/main/src/App.java

if (segments.stream().anyMatch(s -> s.contains(".."))) throw new IllegalArgumentException("path must be normalized");

boolean isSafePathSegment(String s) { return s != null && !s.contains(".."); }

try {
    openBlobPage(params);
} catch (ExplicitException e) {
    renderInvalidPathNotice();
}

When it happens

Trigger: A blob URL where any indexed path segment includes '..' (e.g. /projects/x/blob/commit/dir/../file).

Common situations: Hand-edited or programmatically generated blob URLs collapsing directories, or security scanners probing for traversal vulnerabilities.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Invalid report name
• Invalid report name
• Invalid request path
• Invalid request path
• Invalid parameter 'attachment-group'

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/345280f24363f798. Report an issue: GitHub.