What causes "invalid arguments: %w" in Tencent/WeKnora?

Inspect the wrapped inner error to identify which argument failed and why.

invalid arguments: %w

Error message

invalid arguments: %w

What it means

ValidateStdioConfig wraps any error from ValidateStdioArgs with 'invalid arguments: %w'. The wrapped error carries the specific reason (e.g. an argument matched a dangerous shell-injection pattern). It is a defensive gate ensuring argv entries cannot be abused as shell syntax.

Source

Thrown at internal/utils/security.go:638

				return fmt.Errorf("environment variable '%s' value contains potentially dangerous pattern", key)
			}
		}
	}

	return nil
}

// ValidateStdioConfig performs comprehensive validation of stdio configuration
// This should be called before creating or executing any stdio-based MCP client
func ValidateStdioConfig(command string, args []string, envVars map[string]string) error {
	// Validate command
	if err := ValidateStdioCommand(command); err != nil {
		return fmt.Errorf("invalid command: %w", err)
	}

	// Validate arguments
	if err := ValidateStdioArgs(args); err != nil {
		return fmt.Errorf("invalid arguments: %w", err)
	}

	// Validate environment variables
	if err := ValidateStdioEnvVars(envVars); err != nil {
		return fmt.Errorf("invalid environment variables: %w", err)
	}

	return nil
}

// SSRFSafeHTTPClientConfig contains configuration for the SSRF-safe HTTP client
type SSRFSafeHTTPClientConfig struct {
	Timeout            time.Duration
	MaxRedirects       int
	DisableKeepAlives  bool
	DisableCompression bool
}

View on GitHub (pinned to 988cbb0330)

Solutions

Inspect the wrapped inner error to identify which argument failed and why.
Remove shell metacharacters from arguments; pass plain tokens only.
Split combined shell strings into individual argv entries.
Sanitize user-supplied input before placing it in args.

Example fix

// before
err := secutils.ValidateStdioConfig("node", []string{"server.js; rm -rf /"}, env)
// after
err := secutils.ValidateStdioConfig("node", []string{"server.js"}, env)

Defensive patterns

Strategy: validation

Validate before calling

for _, a := range args {
    if strings.ContainsAny(a, ";|&`$><") { return fmt.Errorf("argument rejected: %q", a) }
}

Type guard

func areSafeArgs(args []string) bool {
    for _, a := range args {
        if strings.ContainsAny(a, ";|&`$><") { return false }
    }
    return true
}

Try / catch

if err := secutils.ValidateStdioConfig(cmd, args, env); err != nil {
    if strings.Contains(err.Error(), "invalid arguments") {
        return fmt.Errorf("check args for shell metacharacters: %w", err)
    }
}

Prevention

Pass each argument as a separate slice element, never one joined string.
Sanitize user input before it lands in args.
Avoid copying raw shell command lines into args.

When it happens

Trigger: Calling ValidateStdioConfig with args containing entries that match DangerousArgPatterns — e.g. backticks, $(), command separators — or otherwise failing ValidateStdioArgs.

Common situations: Args copied from a shell command line (containing ;, |, &&, redirections), dynamically built args from untrusted input, or flags pasted as one string.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/afd099f8273be50d. Report an issue: GitHub.