{"record":{"id":"1149f5c0311a1f1f","repo":"louislam/uptime-kuma","slug":"invalid-service-name-only-alphanumeric-characters","errorCode":null,"errorMessage":"Invalid service name. Only alphanumeric characters and '.', '_', '-' are allowed.","messagePattern":"Invalid service name\\. Only alphanumeric characters and '\\.', '_', '-' are allowed\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/monitor-types/system-service.js","lineNumber":77,"sourceCode":"\n                heartbeat.status = UP;\n                heartbeat.msg = `Service '${serviceName}' is running.`;\n                resolve();\n            });\n        });\n    }\n\n    /**\n     * Windows Check (PowerShell)\n     * @param {string} serviceName The name of the service to check.\n     * @param {object} heartbeat The heartbeat object.\n     * @returns {Promise<void>} Resolves on success, rejects on error.\n     */\n    async checkWindows(serviceName, heartbeat) {\n        return new Promise((resolve, reject) => {\n            // SECURITY: Validate service name to reduce command-injection risk\n            if (!/^[A-Za-z0-9._-]+$/.test(serviceName)) {\n                throw new Error(\"Invalid service name. Only alphanumeric characters and '.', '_', '-' are allowed.\");\n            }\n\n            const cmd = \"powershell\";\n            const args = [\n                \"-NoProfile\",\n                \"-NonInteractive\",\n                \"-Command\",\n                `(Get-Service -Name '${serviceName.replaceAll(\"'\", \"''\")}').Status`,\n            ];\n\n            execFile(cmd, args, { timeout: 5000 }, (error, stdout, stderr) => {\n                let output = (stderr || stdout || \"\").toString().trim();\n                if (output.length > 200) {\n                    output = output.substring(0, 200) + \"...\";\n                }\n\n                if (error || stderr) {\n                    reject(new Error(`Service '${serviceName}' is not running/found.`));","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/louislam/uptime-kuma/blob/6b5ea0155793e666666745fb8d6fef1e829543a2/server/monitor-types/system-service.js#L59-L95","documentation":"Thrown by checkWindows() when the service name fails the regex ^[A-Za-z0-9._-]+$. This guard exists to reduce command-injection risk before interpolating the name into a PowerShell Get-Service command. Note: the Windows regex is stricter than the Linux one — it does NOT allow '@', which the systemd path permits.","triggerScenarios":"Produced on Windows when system_service_name contains any character outside [A-Za-z0-9._-], including spaces, '@', slashes, parentheses, or non-ASCII characters.","commonSituations":"User pastes a service DisplayName (which often has spaces) instead of the internal Service Name; name includes '@' (allowed on Linux but rejected on Windows); copy-paste introduced an invisible character or trailing newline; the service genuinely has a name with an unusual character.","solutions":["Open services.msc and copy the internal Service Name (not the Display Name) — it is usually short and alphanumeric.","Remove any spaces, '@', or symbol characters from the configured name.","If the real Windows service name contains a disallowed character, file a feature request to widen the allow-list safely rather than bypassing the guard.","Run the same regex test locally before saving: /^[A-Za-z0-9._-]+$/.test(name)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function isValidWindowsServiceName(name) { return /^[A-Za-z0-9._-]+$/.test(name); }","typeGuard":"function isValidWindowsServiceName(name) { return typeof name === \"string\" && /^[A-Za-z0-9._-]+$/.test(name); }","tryCatchPattern":"if (!isValidWindowsServiceName(serviceName)) { heartbeat.status = DOWN; heartbeat.msg = \"Invalid service name\"; return; }","preventionTips":["Use the internal Service Name, not the DisplayName.","Validate at form-save time, not just at check time.","Remember '@' is accepted on Linux but rejected on Windows."],"tags":["system-service","windows","validation","security","command-injection"],"backgroundTag":null,"analyzedSha":"6b5ea0155793e666666745fb8d6fef1e829543a2","analyzedAt":"2026-08-12T23:42:12.959Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}