{"record":{"id":"07ce7d346b2fe707","repo":"NationalSecurityAgency/ghidra","slug":"bad-characters-in-one-or-more-proposed-type-07ce7d","errorCode":null,"errorMessage":"Bad characters in one or more proposed ${type}","messagePattern":"Bad characters in one or more proposed (.+?)","errorType":"validation","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java","lineNumber":2900,"sourceCode":"\t\t}\n\t\tif (query.info.execats != null) {\n\t\t\tcheckStrings(query.info.execats, \"categories\", -1);\n\t\t\tconfig.info.execats = query.info.execats;\n\t\t}\n\t\tgenerate(config);\n\t\tresponse.info = config.info;\n\t}\n\n\tprivate static void checkStrings(List<String> list, String type, int limit)\n\t\t\tthrows LSHException {\n\t\tif (limit > 0 && list.size() > limit) {\n\t\t\tthrow new LSHException(\"Too many \" + type + \" specified (limit=\" +\n\t\t\t\tFunctionTagBSimFilterType.MAX_TAG_COUNT + \"): \" + list.size());\n\t\t}\n\t\tSet<String> names = new HashSet<>();\n\t\tfor (String name : list) {\n\t\t\tif (!CategoryRecord.enforceTypeCharacters(name)) {\n\t\t\t\tthrow new LSHException(\"Bad characters in one or more proposed \" + type);\n\t\t\t}\n\t\t\tif (!names.add(name)) {\n\t\t\t\tthrow new LSHException(\"Duplicate \" + type + \" entry specified: \" + name);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Entry point for the InstallCategoryRequest command:\n\t *   Install a new executable category to be managed by the database\n\t * @param query is command parameters\n\t * @throws LSHException if the command is misconfigured\n\t * @throws ElasticException for communication problems with the server\n\t */\n\tprivate void fdbInstallCategory(InstallCategoryRequest query)\n\t\t\tthrows LSHException, ElasticException {\n\t\tResponseInfo response = query.installresponse;\n\t\tif (!CategoryRecord.enforceTypeCharacters(query.type_name)) {","sourceCodeStart":2882,"sourceCodeEnd":2918,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java#L2882-L2918","documentation":"In checkStrings each name is validated by CategoryRecord.enforceTypeCharacters, which rejects null/empty strings and any character that is not alphanumeric, space, '.', '_', ':', '/', '(', ')'. Failure throws LSHException naming the offending 'type'.","triggerScenarios":"Passing a category/tag name (in a list validated by checkStrings) that is empty or contains disallowed punctuation such as '-', ';', '\"', '*', '&', '@', '[', ']', or newlines.","commonSituations":"Auto-generated names derived from file paths/symbols containing punctuation; shell-injected strings with quotes; trailing whitespace or newline from file reads.","solutions":["Sanitize each name to the allowed character set (alphanumeric, space, . _ : / ( )) before submitting.","Strip leading/trailing whitespace and drop empty strings.","Replace common offenders like '-' or '@' with '_'."],"exampleFix":"// before\nList<String> names = readLines(configFile); // contains 'foo-bar'\nquery.setCategories(names);\n// after\nList<String> names = readLines(configFile).stream()\n    .map(s -> s.trim().replaceAll(\"[^A-Za-z0-9 ._:\\/()]\", \"_\"))\n    .filter(s -> !s.isEmpty())\n    .toList();\nquery.setCategories(names);","handlingStrategy":"validation","validationCode":"// Validate every name up front.\nfor (String n : list) {\n    if (!CategoryRecord.enforceTypeCharacters(n))\n        throw new IllegalArgumentException(\"Invalid name: \" + n);\n}","typeGuard":"boolean allValid = list.stream().allMatch(CategoryRecord::enforceTypeCharacters);","tryCatchPattern":null,"preventionTips":["Normalize names at the boundary where they enter your program.","Reject empty strings when building the list."],"tags":["bsim","validation","input-sanitization"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}