What causes "invalid environment variables: %w" in Tencent/WeKnora?

Inspect the wrapped error to see which env var and which rule failed.

invalid environment variables: %w

Error message

invalid environment variables: %w

What it means

ValidateStdioConfig wraps any error from ValidateStdioEnvVars with 'invalid environment variables: %w'. The inner error explains the specific violation: value exceeds 4096 chars, null bytes in value, or a dangerous shell pattern in the value. This is the aggregate entry point for env-var validation failures.

Source

Thrown at internal/utils/security.go:643

	return nil
}

// ValidateStdioConfig performs comprehensive validation of stdio configuration
// This should be called before creating or executing any stdio-based MCP client
func ValidateStdioConfig(command string, args []string, envVars map[string]string) error {
	// Validate command
	if err := ValidateStdioCommand(command); err != nil {
		return fmt.Errorf("invalid command: %w", err)
	}

	// Validate arguments
	if err := ValidateStdioArgs(args); err != nil {
		return fmt.Errorf("invalid arguments: %w", err)
	}

	// Validate environment variables
	if err := ValidateStdioEnvVars(envVars); err != nil {
		return fmt.Errorf("invalid environment variables: %w", err)
	}

	return nil
}

// SSRFSafeHTTPClientConfig contains configuration for the SSRF-safe HTTP client
type SSRFSafeHTTPClientConfig struct {
	Timeout            time.Duration
	MaxRedirects       int
	DisableKeepAlives  bool
	DisableCompression bool
}

// DefaultSSRFSafeHTTPClientConfig returns the default configuration
func DefaultSSRFSafeHTTPClientConfig() SSRFSafeHTTPClientConfig {
	return SSRFSafeHTTPClientConfig{
		Timeout:            30 * time.Second,
		MaxRedirects:       10,

View on GitHub (pinned to 988cbb0330)

Solutions

Inspect the wrapped error to see which env var and which rule failed.
Shorten values exceeding 4096 characters (pass large data via file, not env).
Strip null bytes and shell metacharacters from values.
Validate env values at config ingestion time.

Example fix

// before
envVars["BULK"] = strings.Repeat("x", 8192)
err := secutils.ValidateStdioConfig(cmd, args, envVars)
// after
envVars["BULK"] = strings.Repeat("x", 4000)
err := secutils.ValidateStdioConfig(cmd, args, envVars)

Defensive patterns

Strategy: validation

Validate before calling

for k, v := range envVars {
    if len(v) > 4096 { return fmt.Errorf("env %q too long", k) }
    if strings.Contains(v, "\x00") { return fmt.Errorf("env %q has null bytes", k) }
}

Type guard

func isSafeEnvVar(k, v string) bool {
    return k != "" && len(v) <= 4096 && !strings.Contains(v, "\x00")
}

Try / catch

if err := secutils.ValidateStdioConfig(cmd, args, env); err != nil {
    if strings.Contains(err.Error(), "invalid environment variables") {
        return fmt.Errorf("fix env config: %w", err)
    }
}

Prevention

Keep env values under 4096 chars; move bulk data to files.
Strip null bytes and shell metacharacters at ingestion.
Validate env maps when configuration is first loaded, not at spawn time.

When it happens

Trigger: Calling ValidateStdioConfig with an envVars map where any key/value fails ValidateStdioEnvVars (oversized value >4096, null bytes, or DangerousArgPatterns match).

Common situations: Very large secrets or tokens pasted into env config, values with special characters from shell snippets, or malformed generated configuration.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/ac3615c337aae931. Report an issue: GitHub.