Tencent/WeKnora · error

environment variable

Error message

environment variable '%s' value exceeds maximum length

What it means

ValidateStdioEnvVars limits each environment-variable VALUE to 4096 characters. Values longer than this are rejected to prevent oversized environments that could exhaust process limits or hide injection payloads.

Solutions

1. Move the large value to a file and pass the file path as the env value
2. Compress/encode only if that reduces size below 4096 chars, or split across multiple smaller variables if the server supports it
3. Use a secrets manager / mounted secret file rather than an inline env value
4. Trim the value to only what the server actually needs (e.g. a key id + secret instead of full JSON)

Example fix

// before
"env": {"GOOGLE_APPLICATION_CREDENTIALS_JSON": "<5000-char service account JSON>"}
// after
"env": {"GOOGLE_APPLICATION_CREDENTIALS": "/path/to/sa.json"}

for k, v := range cfg.Env {
    if len(v) > 4096 {
        return fmt.Errorf("env %s value too long (%d > 4096); use a file path instead", k, len(v))
    }
}

if err := ValidateStdioConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "value exceeds maximum length") {
        return fmt.Errorf("move large secret/config to a file and reference its path: %w", err)
    }
    return err
}

When it happens

Trigger: ValidateStdioConfig called with an env map where some value exceeds 4096 bytes — e.g. a giant token, embedded JSON blob, certificate, or concatenated secrets.

Common situations: Embedding service-account JSON or PEM certificates directly in env values; very long JWTs or connection strings; configs that concatenate multiple values into one variable.

Related errors

• environment variable name
• argument exceeds maximum length (1024 characters)
• argument contains null bytes
• command cannot be empty
• environment variable

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/384c855ee35525a8. Report an issue: GitHub.

Appendix: source

Thrown at internal/utils/security.go:609

		return nil
	}

	for key, value := range envVars {
		// Check key against dangerous patterns
		for _, pattern := range DangerousEnvVarPatterns {
			if pattern.MatchString(key) {
				return fmt.Errorf("environment variable '%s' is not allowed for security reasons", key)
			}
		}

		// Check key length
		if len(key) > 256 {
			return fmt.Errorf("environment variable name '%s' exceeds maximum length", SanitizeForLog(key[:50]))
		}

		// Check value length
		if len(value) > 4096 {
			return fmt.Errorf("environment variable '%s' value exceeds maximum length", key)
		}

		// Check for null bytes in value
		if strings.Contains(value, "\x00") {
			return fmt.Errorf("environment variable '%s' value contains null bytes", key)
		}

		// Check value for shell injection patterns
		for _, pattern := range DangerousArgPatterns {
			if pattern.MatchString(value) {
				return fmt.Errorf("environment variable '%s' value contains potentially dangerous pattern", key)
			}
		}
	}

	return nil
}

View on GitHub (pinned to 988cbb0330)