MuntashirAkon/AppManager · error

Error! Invalid characters in arguments.\n

Error message

Error! Invalid characters in arguments.\n

What it means

is_safe_string() rejected at least one of the path-bearing arguments (am_jar_name, main_jar_name, app_id, user_id) because it contains characters unsafe for use in shell exec paths or argument strings (e.g. spaces, quotes, semicolons, path separators or control characters). The binary aborts before doing any filesystem work to avoid command/path injection.

Source

Thrown at app/src/main/cpp/run_server.c:92

        fprintf(stderr,
                "USAGE: %s <port> <token> <am_jar_name> <main_jar_name> <app_id> <user_id> <debug(1|0)> [extra_args...]\n",
                argv[0]);
        return 1;
    }

    const char *port = argv[1];
    const char *token = argv[2];
    const char *am_jar_name = argv[3];
    const char *main_jar_name = argv[4];
    const char *app_id = argv[5];
    const char *user_id = argv[6];
    const char *debug = argv[7];
    const char *bgrun = "1";

    // Validate Paths
    if (!is_safe_string(am_jar_name) || !is_safe_string(main_jar_name) || !is_safe_string(app_id) ||
        !is_safe_string(user_id)) {
        fprintf(stderr, "Error! Invalid characters in arguments.\n");
        return 1;
    }

    // Validate debug and bgrun
    if ((strcmp(debug, "0") != 0 && strcmp(debug, "1") != 0)) {
        fprintf(stderr, "Error! debug must be either 0 or 1.\n");
        return 1;
    }

    // /data/local/tmp/am.jar
    char exec_jar_path[512];
    if (snprintf(exec_jar_path, sizeof(exec_jar_path), "%s/%s", TMP_PATH, am_jar_name) >=
        sizeof(exec_jar_path)) {
        fprintf(stderr, "Error! Buffer overflow on exec_jar_path.\n");
        return 1;
    }

    // /data/local/tmp/main.jar

View on GitHub (pinned to 0152f468fc)

Solutions

1. Sanitize each argument on the caller side before exec (strip/escape unsafe characters, validate against ^[A-Za-z0-9._-]+$)
2. Pass values via a config file or environment instead of shell argv if they can contain arbitrary characters
3. Log/reject the offending value in app code so users see which field was invalid

Example fix

// before
String appId = userInput;
// after
if (!appId.matches("[A-Za-z0-9._-]+")) throw new IllegalArgumentException("invalid app_id");

private static boolean isSafe(String s) {
    return s != null && s.matches("[A-Za-z0-9._-]+") && s.length() <= 256;
}
if (!(isSafe(amJar) && isSafe(mainJar) && isSafe(appId) && isSafe(userId)))
    throw new IllegalArgumentException("unsafe characters in run_server arguments");

function isSafeArg(v: unknown): v is string {
  return typeof v === 'string' && /^[A-Za-z0-9._-]+$/.test(v) && v.length <= 256;
}

When it happens

Trigger: Any of the four validated arguments fails is_safe_string(), e.g. app_id or user_id containing a space, a semicolon, quotes, newlines, or characters outside the allowed safe set.

Common situations: app_id built from untrusted remote data; user_id containing whitespace from a trim-less input; jar filenames pasted with spaces or shell metacharacters; locale/encoding introducing unexpected bytes.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• USAGE: %s <port> <token> <am_jar_name> <main_jar_name> <app_
• Error! debug must be either 0 or 1.\n
• Error! Buffer overflow on exec_jar_path.\n
• Error! Buffer overflow on main_jar_path.\n
• Error! %s could not be found or copied.\n

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/94247e53a94e010f. Report an issue: GitHub.