theonedev/onedev · error · ExplicitException

Invalid request path

Error message

Invalid request path

What it means

The HTML report download resource rejects a report name containing '..' with an ExplicitException 'Invalid request path'. This is a path-traversal guard: '..' in the report name could escape the report directory. It runs after build lookup and before the access check.

Source

Thrown at server-plugin/server-plugin-report-html/src/main/java/io/onedev/server/plugin/report/html/HtmlReportDownloadResource.java:53

	
	@Override
	protected ResourceResponse newResourceResponse(Attributes attributes) {
		var params = attributes.getParameters();

		var projectId = params.get(PARAM_PROJECT).toLong();
		var project = OneDev.getInstance(ProjectService.class).load(projectId);
		
		var buildNumber = params.get(PARAM_BUILD).toLong();
		var build = OneDev.getInstance(BuildService.class).find(project, buildNumber);
		if (build == null) {
			String message = String.format("Unable to find build (project: %s, build number: %d)",
					project.getPath(), buildNumber);
			throw new EntityNotFoundException(message);
		}
		
		String reportName = params.get(PARAM_REPORT).toString();
		if (reportName.contains(".."))
			throw new ExplicitException("Invalid request path");

		if (!SecurityUtils.canAccessReport(build, reportName))
			throw new UnauthorizedException();

		List<String> pathSegments = new ArrayList<>();

		for (int i = 0; i < params.getIndexedCount(); i++) {
			String pathSegment = params.get(i).toString();
			if (pathSegment.contains(".."))
				throw new ExplicitException("Invalid request path");
			if (pathSegment.length() != 0)
				pathSegments.add(pathSegment);
		}

		if (pathSegments.isEmpty())
			throw new ExplicitException("File path has to be specified");

		var filePath = Joiner.on("/").join(pathSegments);

View on GitHub (pinned to d44925c47c)

Solutions

1. Pass a plain report name without any '..' or path separators in the report parameter
2. URL-encode or sanitize the link generated for the report
3. If multiple path levels are needed, use indexed path segments, never '..'

Example fix

// before
report=../../etc
// after
report=my-report

if (reportName.contains("..")) throw new IllegalArgumentException("Report name must not contain '..'");

function isSafeSegment(s) { return typeof s === 'string' && !s.includes('..'); }

try { fetch(url); } catch (ExplicitException e) { // sanitize report name and rebuild URL }

When it happens

Trigger: Requesting the html report download resource with PARAM_REPORT containing '..' (e.g. '../secrets').

Common situations: Hand-crafted or templated URLs with path segments not URL-encoded properly; probing/fragile link generators concatenating paths; security scanners.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Invalid report name
• Invalid report name
• Not authenticated
• Invalid artifact path
• Invalid request path

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/75062ad6633b7aa2. Report an issue: GitHub.