theonedev/onedev · warning · BlobEditException

Not allowed file type: {0}

Error message

Not allowed file type: {0}

What it means

During a blob edit/save, ProjectBlobPage checks the target branch's protection settings for disallowed file types. If the file's extension matches one of them (case-insensitive), a BlobEditException with the localized message 'Not allowed file type: {0}' is thrown and the commit is rejected.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/project/blob/ProjectBlobPage.java:1629

			if (parentPath != null)
				parentPath += "/" + directory;
			else
				parentPath = directory;
		}
		
		User user = Preconditions.checkNotNull(SecurityUtils.getAuthUser());
		BlobIdent blobIdent = getBlobIdent();
		
		boolean signRequired = false;
		for (var item: upload.getItems()) {
			String blobPath = FilenameUtils.sanitizeFileName(FileUpload.getFileName(item));
			if (parentPath != null)
				blobPath = parentPath + "/" + blobPath;
			var blobType = FileExtension.getExtension(blobPath);

			var disallowedFileTypes = getProject().getBranchProtection(blobIdent.revision, user).getDisallowedFileTypes();
			if (disallowedFileTypes.stream().anyMatch(type -> type.equalsIgnoreCase(blobType))) {
				throw new BlobEditException(MessageFormat.format(_T("Not allowed file type: {0}"), blobType));
			}

			if (getProject().isReviewRequiredForModification(user, blobIdent.revision, blobPath)) 
				throw new BlobEditException(_T("Review required for this change. Please submit pull request instead"));
			else if (getProject().isBuildRequiredForModification(user, blobIdent.revision, blobPath)) 
				throw new BlobEditException(_T("Build required for this change. Please submit pull request instead"));
			else if (getProject().isCommitSignatureRequiredButNoSigningKey(user, blobIdent.revision)) 
				signRequired = true;
			
			BlobContent blobContent = new BlobContent(item.get(), FileMode.REGULAR_FILE.getBits());
			newBlobs.put(blobPath, blobContent);
		}

		BlobEdits blobEdits = new BlobEdits(Sets.newHashSet(), newBlobs);
		String refName = blobIdent.revision!=null? GitUtils.branch2ref(blobIdent.revision):"refs/heads/main";

		ObjectId prevCommitId;
		if (blobIdent.revision != null)

View on GitHub (pinned to d44925c47c)

Solutions

1. Remove the file type from the branch protection's disallowed file types list (Branch Protection -> Disallowed File Types)
2. Use a different file format or host the artifact outside the repository
3. Commit via a pull request from an unprotected branch if policy permits

Example fix

// before: committing build/app.exe to protected main with '*.exe' disallowed
// after: remove '*.exe' from branch protection, or commit to a feature branch and open a PR

var ext = FileExtension.getExtension(blobPath);
var disallowed = project.getBranchProtection(revision, user).getDisallowedFileTypes();
if (disallowed.stream().anyMatch(t -> t.equalsIgnoreCase(ext))) { /* block before save */ }

try {
    saveBlob();
} catch (BlobEditException e) {
    showSaveError(e.getMessage());
}

When it happens

Trigger: Committing/renaming/adding a file via the web editor whose extension is on the branch protection's disallowed file types list (e.g. .exe, .jar).

Common situations: Uploading binaries to a protected branch from the web UI; branch protection recently tightened; extension casing like .EXE still matched via equalsIgnoreCase.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Review required for this change. Please submit pull request
• Unable to remove mandatory reviewers:
• Branch creation prohibited by branch protection rule
• Cannot create this branch as branch protection setting requi
• Valid signature required for head commit of this branch per

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/bd17e81c5e551a93. Report an issue: GitHub.