{"record":{"id":"17262cf73e8c997e","repo":"windmill-labs/windmill","slug":"invalid-vault-id-value-expected-label-filena","errorCode":null,"errorMessage":"Invalid vault_id `{value}`: expected `label@filename` using only letters, digits and the characters `.`, `_`, `-`, `/`, `@`","messagePattern":"Invalid vault_id `(.+?)`: expected `label@filename` using only letters, digits and the characters `\\.`, `_`, `-`, `/`, `@`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/parsers/windmill-parser-yaml/src/lib.rs","lineNumber":463,"sourceCode":"        }\n    }\n\n    Ok(DelegateWithSSHAuth { delegate_to_git_repo_details: None, git_ssh_identity })\n}\n\n/// Each `vault_id` entry is interpolated verbatim into the generated `ansible.cfg`\n/// (`vault_identity_list = <a>,<b>,...`). A newline or other config-meaningful\n/// character would let a script inject arbitrary `[defaults]` directives (e.g.\n/// `library`, `action_plugins`) and execute attacker-controlled code on the worker,\n/// and a `,` would smuggle in an extra entry. Restrict entries to the `label@source`\n/// charset so neither is possible.\npub fn validate_vault_id(value: &str) -> anyhow::Result<()> {\n    let is_valid = !value.is_empty()\n        && value\n            .chars()\n            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-' | '/' | '@'));\n    if !is_valid {\n        return Err(anyhow!(\n            \"Invalid vault_id `{value}`: expected `label@filename` using only letters, digits and the characters `.`, `_`, `-`, `/`, `@`\"\n        ));\n    }\n    Ok(())\n}\n\npub fn parse_ansible_reqs(\n    inner_content: &str,\n) -> anyhow::Result<(String, Option<AnsibleRequirements>, String)> {\n    let mut logs = String::new();\n    let docs = YamlLoader::load_from_str(inner_content)\n        .map_err(|e| anyhow!(\"Failed to parse yaml: {}\", e))?;\n\n    let mut ret = AnsibleRequirements::default();\n\n    if let Yaml::Hash(doc) = &docs[0] {\n        if let Some(v) = doc.get(&Yaml::String(\"delegate_to_git_repo\".to_string())) {\n            ret.delegate_to_git_repo = extract_delegate_to_git_repo_details(v);","sourceCodeStart":445,"sourceCodeEnd":481,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/parsers/windmill-parser-yaml/src/lib.rs#L445-L481","documentation":"validate_vault_id enforces the ansible-vault id format `label@filename` and a conservative character set: non-empty, only ASCII alphanumerics plus `.`, `_`, `-`, `/`, `@`. Anything else (spaces, unicode, empty string) is rejected with this message.","triggerScenarios":"parse_ansible_reqs, create_ansible_cfg, or build_ansible_cfg_override_envs calls validate_vault_id with a vault_id string containing forbidden characters — typically a space or empty value.","commonSituations":"Writing a vault id with a space after the `@`, using an environment variable that is unset/empty, or including special shell characters in the label.","solutions":["Format the value as `label@filename` with no spaces.","Remove or replace forbidden characters (spaces, colons, unicode) in label and filename.","Check that the variable feeding the vault_id is actually set and non-empty."],"exampleFix":"// before\nvault_id: \"my vault@file name\"\n// after\nvault_id: \"myvault@filename\"","handlingStrategy":"validation","validationCode":"fn valid_vault_id(v: &str) -> bool {\n    !v.is_empty() && v.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-' | '/' | '@'))\n}","typeGuard":"fn is_valid_vault_id(s: &str) -> bool {\n    !s.is_empty() && s.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-' | '/' | '@'))\n}","tryCatchPattern":"if let Err(e) = validate_vault_id(candidate) {\n    eprintln!(\"{e}; using fallback\");\n    // sanitize: strip disallowed chars, rebuild label@filename\n}","preventionTips":["Keep vault ids to [A-Za-z0-9._/@-] only","Check env vars feeding vault_id are set and space-free","Quote YAML values so no implicit type coercion occurs"],"tags":["ansible","vault","validation","format"],"backgroundTag":"format-validation-failed","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}