{"record":{"id":"0df9ba06688aa181","repo":"Tencent/WeKnora","slug":"invalid-command-w","errorCode":null,"errorMessage":"invalid command: %w","messagePattern":"invalid command: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":633,"sourceCode":"\t\t}\n\n\t\t// Check value for shell injection patterns\n\t\tfor _, pattern := range DangerousArgPatterns {\n\t\t\tif pattern.MatchString(value) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains potentially dangerous pattern\", key)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// ValidateStdioConfig performs comprehensive validation of stdio configuration\n// This should be called before creating or executing any stdio-based MCP client\nfunc ValidateStdioConfig(command string, args []string, envVars map[string]string) error {\n\t// Validate command\n\tif err := ValidateStdioCommand(command); err != nil {\n\t\treturn fmt.Errorf(\"invalid command: %w\", err)\n\t}\n\n\t// Validate arguments\n\tif err := ValidateStdioArgs(args); err != nil {\n\t\treturn fmt.Errorf(\"invalid arguments: %w\", err)\n\t}\n\n\t// Validate environment variables\n\tif err := ValidateStdioEnvVars(envVars); err != nil {\n\t\treturn fmt.Errorf(\"invalid environment variables: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// SSRFSafeHTTPClientConfig contains configuration for the SSRF-safe HTTP client\ntype SSRFSafeHTTPClientConfig struct {\n\tTimeout            time.Duration","sourceCodeStart":615,"sourceCodeEnd":651,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L615-L651","documentation":"ValidateStdioConfig wraps any error from ValidateStdioCommand with the prefix 'invalid command: %w'. The inner error explains the specific reason — e.g. empty command, path traversal, disallowed binary, or dangerous pattern in the command. Check errors.Unwrap/Is to reach the cause.","triggerScenarios":"Calling ValidateStdioConfig with a command string that fails ValidateStdioCommand: empty string, path-traversal paths, disallowed executables, or commands matching dangerous patterns.","commonSituations":"Typo in the binary name, configuring a command not on the allowed list, or storing a full shell line (e.g. \"python -m foo\") in the command field instead of separating args.","solutions":["Inspect the wrapped error (errors.Unwrap or %v) to see the specific ValidateStdioCommand reason.","Use a plain executable name or an allowed absolute path with no shell metacharacters.","Move extra tokens into the args []string parameter rather than embedding them in the command string.","Verify the command exists and is permitted (PATH lookup / allowlist) before validation."],"exampleFix":"// before\nerr := secutils.ValidateStdioConfig(\"python -m server\", nil, env)\n// after\nerr := secutils.ValidateStdioConfig(\"python\", []string{\"-m\", \"server\"}, env)","handlingStrategy":"validation","validationCode":"if command == \"\" { return errors.New(\"command is required\") }\nif strings.ContainsAny(command, \";|&`$\\\\\") { return errors.New(\"command must be a plain executable\") }\nif _, err := exec.LookPath(command); err != nil { return fmt.Errorf(\"command not found: %w\", err) }","typeGuard":"func isValidCommand(cmd string) bool {\n    return cmd != \"\" && !strings.ContainsAny(cmd, \";|&`$\\\\\")\n}","tryCatchPattern":"if err := secutils.ValidateStdioConfig(cmd, args, env); err != nil {\n    return fmt.Errorf(\"stdio config rejected: %w\", err) // Unwrap for the specific cause\n}","preventionTips":["Keep command a bare executable name; put flags in args.","Verify the binary exists via exec.LookPath before configuring.","Never embed shell syntax in the command field."],"tags":["security","validation","stdio","command-execution"],"backgroundTag":"invalid-command","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}