{"record":{"id":"05b76519580ea761","repo":"docker/cli","slug":"invalid-host-w","errorCode":null,"errorMessage":"invalid host: %w","messagePattern":"invalid host: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/connhelper/ssh/ssh.go","lineNumber":131,"sourceCode":"\t\t}\n\t\targs = append(args, \"-l\", usr)\n\t}\n\tif sp.Port != \"\" {\n\t\t// Quote port, as it's obtained from the URL.\n\t\tport, err := syntax.Quote(sp.Port, syntax.LangPOSIX)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid port: %w\", err)\n\t\t}\n\t\targs = append(args, \"-p\", port)\n\t}\n\n\t// We consider \"sshFlags\" to be \"trusted\", and set from code only,\n\t// as they are not parsed from the DOCKER_HOST URL.\n\targs = append(args, sshFlags...)\n\n\thost, err := syntax.Quote(sp.Host, syntax.LangPOSIX)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid host: %w\", err)\n\t}\n\n\treturn append(args, \"--\", host), nil\n}\n\n// Command returns the ssh flags and arguments to execute a command\n// (remoteCommandAndArgs) on the remote host. Where needed, it quotes\n// values passed in remoteCommandAndArgs to account for ssh executing\n// the remote command in a shell. It returns an error if no remote command\n// is passed, or when unable to quote the remote command.\n//\n// Important: to preserve backward-compatibility, Command does not currently\n// perform sanitization or quoting on the sshFlags and callers are expected\n// to sanitize this argument.\nfunc (sp *Spec) Command(sshFlags []string, remoteCommandAndArgs ...string) ([]string, error) {\n\tif len(remoteCommandAndArgs) == 0 {\n\t\treturn nil, errors.New(\"no remote command specified\")\n\t}","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/connhelper/ssh/ssh.go#L113-L149","documentation":"Raised in Spec.args (ssh.go:129-131) when the host portion of the ssh URL cannot be POSIX-shell-quoted by syntax.Quote. The host is taken from u.Hostname() and passed as the final positional argument to ssh after `--`; if it contains bytes the quoting library rejects, this wraps the error.","triggerScenarios":"Spec.args/Args/Command is called after building a Spec from a URL whose Host field contains characters syntax.Quote cannot handle, such as a NUL byte or other non-printable control character that cannot appear in a safe POSIX token.","commonSituations":"A DOCKER_HOST ssh URL whose hostname has a hidden control byte (often from a corrupted env var, a templating bug, or a paste with invisible characters). In normal operation hostnames are clean and this error is never seen.","solutions":["Inspect the hostname in the DOCKER_HOST URL for invisible/control characters.","Re-enter the hostname as plain ASCII (letters, digits, dots, hyphens).","Percent-encode any legitimately special characters in the URL host."],"exampleFix":"# before — invisible control char in host\nexport DOCKER_HOST='ssh://user@host<x00>.example.com'\n# after\nexport DOCKER_HOST='ssh://user@host.example.com'","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(daemonURL)\nif u != nil {\n    h := u.Hostname()\n    if h == \"\" {\n        return errors.New(\"ssh URL host is empty\")\n    }\n    for _, r := range h {\n        if r < 0x20 || r > 0x7e {\n            return errors.New(\"ssh URL host contains control characters\")\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"args, err := spec.Args(remote...)\nif err != nil {\n    return fmt.Errorf(\"cannot build ssh args (bad host?): %w\", err)\n}","preventionTips":["Restrict DOCKER_HOST hostnames to printable ASCII (letters, digits, dots, hyphens).","Sanitize env-sourced values for hidden characters.","Add a CI lint for DOCKER_HOST format."],"tags":["connhelper","ssh","url","host","quoting","shell-injection"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}