theonedev/onedev · warning · ExplicitException

Invalid request path

Error message

Invalid request path

What it means

RawBlobResource validates each indexed path segment of the raw blob URL; any segment containing '..' is rejected with ExplicitException to prevent path traversal out of the repository. This is a deliberate security guard, not a data problem.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/resource/RawBlobResource.java:71

	
	private static final String PARAM_DISPOSITION = "disposition";
	
	private static final Logger logger = LoggerFactory.getLogger(RawBlobResource.class);

	@Override
	protected ResourceResponse newResourceResponse(Attributes attributes) {
		PageParameters params = attributes.getParameters();

		String projectPath = params.get(ProjectMapperUtils.PARAM_PROJECT).toString();
		Project project = getProjectService().findByPath(projectPath);
		if (project == null)
			throw new EntityNotFoundException("Project not found: " + projectPath);
		
		List<String> revisionAndPathSegments = new ArrayList<>();
		for (int i = 0; i < params.getIndexedCount(); i++) {
			String segment = params.get(i).toString();
			if (segment.contains(".."))
				throw new ExplicitException("Invalid request path");
			if (segment.length() != 0)
				revisionAndPathSegments.add(segment);
		}

		BlobIdent blobIdent = new BlobIdent(project, revisionAndPathSegments);

		String revision = blobIdent.revision;
		String path = blobIdent.path;
		if (StringUtils.isBlank(revision) || StringUtils.isBlank(path))
			throw new NotAcceptableException("Revision and path should be specified");

		if (!SecurityUtils.canReadCode(project))
			throw new UnauthorizedException();

		final Blob blob = project.getBlob(new BlobIdent(revision, path, 0), true);

		ResourceResponse response = new ResourceResponse();
		response.setAcceptRange(ContentRangeType.BYTES);

View on GitHub (pinned to d44925c47c)

Solutions

1. Remove '..' segments from the requested path in your URL builder or script.
2. Normalize the file path relative to the repo root before constructing the raw URL.
3. Ensure scanners/tools do not send traversal-style URLs to this endpoint.

Example fix

// before
String url = "/~raw/proj/main/" + "docs/../../README.md";
// after
String url = "/~raw/proj/main/" + Path.of("docs/../README.md").normalize();

if (filePath.split("/").anyMatch(seg -> seg.equals(".."))) throw new IllegalArgumentException("Path must not contain '..'");

boolean isSafeSegment(String s) { return s != null && !s.contains(".."); }

When it happens

Trigger: Requesting a raw blob URL where any path segment contains '..' (e.g. /~raw/proj/main/../../secret) — typically hand-crafted or malicious URLs.

Common situations: Path traversal probing/scanning; buggy URL builders that don't normalize '..' out of file paths; users pasting manipulated URLs.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Invalid attachment parameter
• Invalid request path
• Invalid report name
• Invalid report name
• Invalid request path

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/f541b8a6093bd97b. Report an issue: GitHub.