{"record":{"id":"0436c2ae957641a0","repo":"yudai/gotty","slug":"failed-to-parse-arguments","errorCode":null,"errorMessage":"failed to parse arguments","messagePattern":"failed to parse arguments","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/handlers.go","lineNumber":115,"sourceCode":"\t}\n\n\tvar init InitMessage\n\terr = json.Unmarshal(initLine, &init)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"failed to authenticate websocket connection\")\n\t}\n\tif init.AuthToken != server.options.Credential {\n\t\treturn errors.New(\"failed to authenticate websocket connection\")\n\t}\n\n\tqueryPath := \"?\"\n\tif server.options.PermitArguments && init.Arguments != \"\" {\n\t\tqueryPath = init.Arguments\n\t}\n\n\tquery, err := url.Parse(queryPath)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"failed to parse arguments\")\n\t}\n\tparams := query.Query()\n\tvar slave Slave\n\tslave, err = server.factory.New(params)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"failed to create backend\")\n\t}\n\tdefer slave.Close()\n\n\ttitleVars := server.titleVariables(\n\t\t[]string{\"server\", \"master\", \"slave\"},\n\t\tmap[string]map[string]interface{}{\n\t\t\t\"server\": server.options.TitleVariables,\n\t\t\t\"master\": map[string]interface{}{\n\t\t\t\t\"remote_addr\": conn.RemoteAddr(),\n\t\t\t},\n\t\t\t\"slave\": slave.WindowTitleVariables(),\n\t\t},","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/yudai/gotty/blob/a080c85cbc59226c94c6941ad8c395232d72d517/server/handlers.go#L97-L133","documentation":"Wrapped url.Parse error in processWSConn: the query string built from the client-supplied Arguments field (when PermitArguments is on) is not a parseable URL query string, e.g. it contains malformed percent-encoding or stray characters. The attacker-controlled init.Arguments is the input at fault.","triggerScenarios":"Thrown at server/handlers.go:115 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject or URL-sanitize init.Arguments before parsing instead of passing it through","Run with PermitArguments disabled unless clients are trusted","Return a 4xx-style close to the master so the client sees the arguments were invalid"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a080c85cbc59226c94c6941ad8c395232d72d517","analyzedAt":"2026-09-02T16:42:38.150Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}