What causes "configuration value contains illegal characters" in Billionmail/BillionMail?

Remove shell metacharacters from the value and save only the bare token

configuration value contains illegal characters

Error message

configuration value contains illegal characters

What it means

After key-specific checks pass, validateConfigValue runs a general safety check with public.ContainsDangerousChars and rejects any value containing characters considered dangerous (typically shell/command-injection metacharacters). Because config values are interpolated into service config files and shell-managed deployment steps, these characters could enable injection.

Source

Thrown at core/internal/controller/settings/settings.go:245

		if !public.IsValidTimezone(value) {
			return fmt.Errorf("invalid timezone")
		}

	case "FAIL2BAN_INIT", "fail2ban":
		// fail2ban: only allowed y/n or 1/0
		if value != "y" && value != "n" && value != "1" && value != "0" {
			return fmt.Errorf("fail2ban value can only be y/n or 1/0")
		}
	case "RETENTION_DAYS", "retention_days":
		// retention_days: must be a number
		if _, err := strconv.Atoi(value); err != nil {
			return fmt.Errorf("retention_days must be a number")
		}
	}

	// General character check: not allowed dangerous characters
	if public.ContainsDangerousChars(value) {
		return fmt.Errorf("configuration value contains illegal characters")
	}

	return nil
}

View on GitHub (pinned to fc36c76c05)

Solutions

Remove shell metacharacters from the value and save only the bare token
Strip surrounding quotes and whitespace before calling the API
Sanitize on the client side with a whitelist regex per config key
If a legitimate value needs such a character, use the supported alternative syntax (e.g. CIDR or FQDN formats)

Example fix

// before
BILLIONMAIL_HOSTNAME = "mail.example.com"; rm -rf /
// after
BILLIONMAIL_HOSTNAME = mail.example.com

Defensive patterns

Strategy: validation

Validate before calling

const dangerous = /[;&|`$\\<>"'\n\r]/;
if (dangerous.test(value)) throw new Error('configuration value contains illegal characters');

Try / catch

try {
  await api.setSystemConfigKey(key, value);
} catch (e) {
  if (String(e.message).includes('illegal characters')) {
    notify('Remove shell metacharacters (;, |, &, $, backticks, quotes) from the value');
  } else throw e;
}

Prevention

Whitelist-validate each config key's expected format before submit
Strip surrounding quotes and trailing newlines from pasted input
Never paste shell commands into config fields
Treat this error as a potential injection attempt — audit the input source

When it happens

Trigger: Any config value containing metacharacters such as ; | & $ ` \ " ' newlines or redirection operators — even for keys that have no dedicated format validator.

Common situations: Users paste shell snippets into config fields, include quoting around values ('"mail.example.com"'), or values carry trailing newline characters from clipboard copies.

Related errors

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/cf206e09537ad2bc. Report an issue: GitHub.