{"record":{"id":"1082e311eaaa28e8","repo":"FlowiseAI/Flowise","slug":"user-id-contains-invalid-characters-allowed-lett","errorCode":null,"errorMessage":"User ID contains invalid characters. Allowed: letters, digits, . _ @ + -","messagePattern":"User ID contains invalid characters\\. Allowed: letters, digits, \\. _ @ \\+ -","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/nodes/tools/MCP/Pipedream/PipedreamMCP.ts","lineNumber":292,"sourceCode":"                throw new Error(\n                    'Variables in User ID are not resolved. ' +\n                        '{{$vars.*}} requires a matching workspace variable. ' +\n                        '{{$flow.*}} variables (e.g. sessionId) are only available at runtime, not when refreshing actions.'\n                )\n            }\n            // For loadMethods context, use a sanitized fallback so tool listing still works.\n            // The actual externalUserId will be resolved at runtime.\n            externalUserId = 'flowise_preview_user'\n        }\n\n        externalUserId = externalUserId.replace(/<[^>]*>/g, '').trim()\n        if (!externalUserId) {\n            throw new Error('Pipedream user ID is required')\n        }\n\n        const SAFE_USER_ID = /^[a-zA-Z0-9._@+-]{1,250}$/\n        if (!SAFE_USER_ID.test(externalUserId.trim())) {\n            throw new Error('User ID contains invalid characters. Allowed: letters, digits, . _ @ + -')\n        }\n\n        const credentialData = await getCredentialData(nodeData.credential ?? '', options)\n        const projectId = getCredentialParam('projectId', credentialData, nodeData)\n        const oauthScopes = getCredentialParam('oauthScopes', credentialData, nodeData) as string | 'connect:*'\n\n        if (!projectId) {\n            throw new Error('Pipedream Project ID is required in credentials')\n        }\n\n        const clientId = getCredentialParam('clientId', credentialData, nodeData)\n        const clientSecret = getCredentialParam('clientSecret', credentialData, nodeData)\n\n        if (!clientId || !clientSecret) {\n            throw new Error('Pipedream Client ID and Client Secret are required in credentials')\n        }\n        const accessToken = await this.fetchAccessToken(clientId, clientSecret, oauthScopes)\n","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/nodes/tools/MCP/Pipedream/PipedreamMCP.ts#L274-L310","documentation":"Thrown when externalUserId (after trim) fails the SAFE_USER_ID regex /^[a-zA-Z0-9._@+-]{1,250}$/. This prevents characters outside the allowed set (and over-length values) from being passed to Pipedream as the external user identifier.","triggerScenarios":"externalUserId contains spaces, colons, slashes, Unicode, emoji, angle brackets that survived stripping, or exceeds 250 characters.","commonSituations":"User entered an email with a display name 'Jane Doe <j@x.com>'; a UUID with hyphens is fine but a value with spaces is not; pasted a long JSON blob; Unicode username from an external IdP.","solutions":["Use a plain identifier: letters, digits, dot, underscore, at, plus, hyphen only.","Strip display names/angles from emails; use the bare address.","If the source value is a UUID, that already passes; if it is a free-text username, sanitize it upstream.","Keep the value under 250 characters."],"exampleFix":"// before: externalUserId = 'Jane Doe <jane@example.com>'\n// after:  externalUserId = 'jane@example.com'","handlingStrategy":"validation","validationCode":"const SAFE_USER_ID = /^[a-zA-Z0-9._@+-]{1,250}$/\nconst uid = (externalUserId || '').trim()\nif (!SAFE_USER_ID.test(uid)) {\n    throw new Error('User ID contains invalid characters')\n}","typeGuard":"function isSafeUserId(s: string): boolean {\n    return /^[a-zA-Z0-9._@+-]{1,250}$/.test(s.trim())\n}","tryCatchPattern":"try { await pipedream.getTools(nodeData, options) }\ncatch (e) { if (e instanceof Error && e.message.startsWith('User ID contains invalid characters')) { /* sanitize input */ } }","preventionTips":["Strip display-name formatting from emails before they reach the field.","Validate length and charset in the UI with the same regex."],"tags":["pipedream","validation","input-sanitization","regex","security"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}