NationalSecurityAgency/ghidra · error · IllegalArgumentException

Bad character in H2 database path. Disallowed characters:

Error message

Bad character in H2 database path. Disallowed characters: 

What it means

Thrown by cleanupFilename() when a file-type database name contains one of the disallowed H2 characters defined in BAD_H2_CHARS (semicolon ';', single quote, double quote "). These characters are blocked because H2 interprets them in connection/file paths and could cause injection or path errors. Throws IllegalArgumentException.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimServerInfo.java:251

			return null;
		}
		userinfo = userinfo.trim();
		int pwdSep = userinfo.indexOf(':');
		if (pwdSep == 0) {
			throw new IllegalArgumentException("Invalid userinfo specified");
		}
		else if (pwdSep > 0 && (userinfo.length() - pwdSep) == 0) {
			throw new IllegalArgumentException("Invalid userinfo specified");
		}
		return userinfo;
	}

	private static String cleanupFilename(String name) {
		// transform dbName into acceptable H2 DB file path

		Matcher m = BAD_H2_CHARS_PATTERN.matcher(name);
		if (m.matches()) {
			throw new IllegalArgumentException("Bad character in H2 database path. " +
				"Disallowed characters: " + BAD_H2_CHARS);
		}
		String dbName = name.trim();
		dbName = dbName.replace("\\", "/");
		if ((!dbName.startsWith("/") && !isWindowsFilePath(dbName)) || dbName.endsWith("/")) {
			throw new IllegalArgumentException("Invalid absolute file path: " + dbName);
		}
		if (!dbName.endsWith(H2_FILE_EXTENSION)) {
			dbName += H2_FILE_EXTENSION;
		}
		return dbName;
	}

	private static String checkURLField(String val, String name) {
		if (StringUtils.isEmpty(val)) {
			throw new IllegalArgumentException("Invalid " + name + " in URL");
		}
		return val.trim();

View on GitHub (pinned to d5f144c24d)

Solutions

1. Remove or escape the disallowed characters (';', single quote, double quote) from the file path.
2. Validate the path against the BAD_H2_CHARS set before constructing BSimServerInfo.
3. Rename the target H2 file to avoid the forbidden characters.

Example fix

// before
new BSimServerInfo("/data/bsim;drop.mv.db");
// after (no disallowed chars)
new BSimServerInfo("/data/bsimdrop.mv.db");

if (dbName.matches(".*[;'\"].*")) {
    throw new IllegalArgumentException("H2 path contains disallowed chars (;, ', \"): " + dbName);
}

When it happens

Trigger: Constructing a file-type BSimServerInfo with a path containing ';', "', or '"', e.g. 'new BSimServerInfo("/data/my;evil.mv.db")'.

Common situations: User-supplied or templated paths that include quotes or semicolons; paths copied from configuration that contains shell-special characters.

Related errors

• Remote file URL not supported: {}
• Invalid absolute file path:
• host required
• Non-empty dbName required
• Invalid {} dbName: {}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/71ed4d6166cd13ca. Report an issue: GitHub.