{"record":{"id":"10f26e12cf5576be","repo":"paperclipai/paperclip","slug":"packagename-contains-invalid-characters","errorCode":null,"errorMessage":"packageName contains invalid characters","messagePattern":"packageName contains invalid characters","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"server/src/routes/plugins.ts","lineNumber":1171,"sourceCode":"      res.status(400).json({ error: \"version must be a string if provided\" });\n      return;\n    }\n\n    if (isLocalPath !== undefined && typeof isLocalPath !== \"boolean\") {\n      res.status(400).json({ error: \"isLocalPath must be a boolean if provided\" });\n      return;\n    }\n\n    // Validate package name format\n    const trimmedPackage = packageName.trim();\n    if (trimmedPackage.length === 0) {\n      res.status(400).json({ error: \"packageName cannot be empty\" });\n      return;\n    }\n\n    // Basic security check for package name (prevent injection)\n    if (!isLocalPath && /[<>:\"|?*]/.test(trimmedPackage)) {\n      res.status(400).json({ error: \"packageName contains invalid characters\" });\n      return;\n    }\n\n    // Cloud install floor: on harness-managed instances only bundled-catalog\n    // sources are installable, regardless of actor privileges or flag state.\n    const cloudManaged = isCloudManagedInstance();\n    if (cloudManaged && !isLocalPath) {\n      res.status(403).json({\n        error:\n          \"npm installs are disabled on cloud-managed instances; only plugins bundled with the application may be installed\",\n      });\n      return;\n    }\n\n    // Canonicalize local install paths on every instance so traversal\n    // segments and symlinks cannot smuggle an aliased path past validation.\n    let canonicalLocalPath: string | undefined;\n    if (isLocalPath) {","sourceCodeStart":1153,"sourceCodeEnd":1189,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/routes/plugins.ts#L1153-L1189","documentation":"400 security guard on POST /plugins/install. Fires when a non-local-path package name contains shell/OS-unsafe characters (<>:\"|?*); a basic injection-prevention check rejects such names before registry or filesystem access.","triggerScenarios":"Thrown at server/src/routes/plugins.ts:1155 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the offending parameter to satisfy the constraint stated in the error message (type, range, or allowed values), then retry.","Refer to the route's request validation in the named file and the shared validators for the accepted format."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}