{"record":{"id":"18e6691b0cfabc2f","repo":"mikefarah/yq","slug":"system-operator-command-must-be-a-non-empty-strin","errorCode":null,"errorMessage":"system operator: command must be a non-empty string","messagePattern":"system operator: command must be a non-empty string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/yqlib/operator_system.go","lineNumber":56,"sourceCode":"\tif argsNode.Kind != ScalarNode {\n\t\treturn nil, fmt.Errorf(\"system operator: args must be a non-null scalar or sequence of non-null scalars; got kind=%v tag=%v\", argsNode.Kind, argsNode.Tag)\n\t}\n\treturn []string{argsNode.Value}, nil\n}\n\nfunc resolveCommandNode(commandNodes Context) (string, error) {\n\tif commandNodes.MatchingNodes.Front() == nil {\n\t\treturn \"\", fmt.Errorf(\"system operator: command expression returned no results\")\n\t}\n\tif commandNodes.MatchingNodes.Len() > 1 {\n\t\tlog.Debugf(\"system operator: command expression returned %d results, using first\", commandNodes.MatchingNodes.Len())\n\t}\n\tcmdNode := commandNodes.MatchingNodes.Front().Value.(*CandidateNode)\n\tif cmdNode.Kind != ScalarNode || cmdNode.guessTagFromCustomType() != \"!!str\" {\n\t\treturn \"\", fmt.Errorf(\"system operator: command must be a string scalar\")\n\t}\n\tif cmdNode.Value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"system operator: command must be a non-empty string\")\n\t}\n\treturn cmdNode.Value, nil\n}\n\nfunc systemOperator(d *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {\n\tif !ConfiguredSecurityPreferences.EnableSystemOps {\n\t\treturn Context{}, fmt.Errorf(\"system operations are disabled, use --security-enable-system-operator to enable\")\n\t}\n\n\t// determine at parse time whether we have (command; args) or just (command)\n\thasArgs := expressionNode.RHS.Operation.OperationType == blockOpType\n\n\tvar results = list.New()\n\n\tfor el := context.MatchingNodes.Front(); el != nil; el = el.Next() {\n\t\tcandidate := el.Value.(*CandidateNode)\n\t\tnodeContext := context.SingleReadonlyChildContext(candidate)\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/mikefarah/yq/blob/8b5af0694bb82b41d4ae180fac9972029066f90a/pkg/yqlib/operator_system.go#L38-L74","documentation":"The `system` operator rejects an empty-string command. After confirming the command node is a string scalar, resolveCommandNode checks that it is non-empty; an empty string cannot name a program to execute and is treated as an error rather than a no-op.","triggerScenarios":"The command field exists in the YAML but is empty, e.g. `cmd: \"\"` or `cmd:` with no value resolved to an empty scalar, then `system(.cmd)` is evaluated.","commonSituations":"Unset config values in CI pipelines (empty env-derived placeholders), template-rendered files where the command was substituted with an empty string, or optional fields defaulted to \"\".","solutions":["Supply a default command: `system(.cmd // \"echo\")` so empty resolves to a valid command","Guard before running: only evaluate system when the command is non-empty, e.g. wrap in an if: `select(.cmd != \"\") | system(.cmd)`","Fix the input document so the command field contains the actual program name"],"exampleFix":"// before: .cmd is \"\" in the document\nsystem(.cmd)\n// after: guard against empty\nselect(.cmd != \"\" and .cmd != null) | system(.cmd)","handlingStrategy":"validation","validationCode":"// skip empty commands\nselect(.cmd != null and .cmd != \"\") | system(.cmd)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default empty fields: .cmd // \"echo\"","Validate input documents for unset/empty command fields before running system()","In CI, ensure env-substituted placeholders are populated"],"tags":["yq","system-operator","validation","empty-string"],"backgroundTag":"empty-string-argument","analyzedSha":"8b5af0694bb82b41d4ae180fac9972029066f90a","analyzedAt":"2026-09-05T10:57:22.766Z","contentChangedAt":"2026-09-05T10:57:22.766Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}