{"record":{"id":"19561fe19c2bcc05","repo":"n8n-io/n8n","slug":"wildcard-in-list-name-must-be-used-alone-no","errorCode":null,"errorMessage":"Wildcard '*' in {list_name} must be used alone, not with other modules. Got: {', '.join(sorted(modules))}","messagePattern":"Wildcard '\\*' in (.+?) must be used alone, not with other modules\\. Got: (.+?)","errorType":"validation","errorClass":"ConfigurationError","httpStatus":null,"severity":"error","filePath":"packages/@n8n/task-runner-python/src/config/task_runner_config.py","lineNumber":41,"sourceCode":"    ENV_TASK_TIMEOUT,\n    ENV_AUTO_SHUTDOWN_TIMEOUT,\n    ENV_GRACEFUL_SHUTDOWN_TIMEOUT,\n    PIPE_MSG_MAX_SIZE,\n)\n\n\ndef parse_allowlist(allowlist_str: str, list_name: str) -> set[str]:\n    if not allowlist_str:\n        return set()\n\n    modules = {\n        module\n        for raw_module in allowlist_str.split(\",\")\n        if (module := raw_module.strip())\n    }\n\n    if \"*\" in modules and len(modules) > 1:\n        raise ConfigurationError(\n            f\"Wildcard '*' in {list_name} must be used alone, not with other modules. \"\n            f\"Got: {', '.join(sorted(modules))}\"\n        )\n\n    return modules\n\n\n@dataclass\nclass TaskRunnerConfig:\n    grant_token: str\n    # Empty to self-assign an ID, the default in `external` mode where no one else\n    # knows this runner beforehand. Must be unique per runner when set: the broker keys\n    # connections by runner ID, so two runners sharing one keep evicting each other.\n    runner_id: str\n    task_broker_uri: str\n    max_concurrency: int\n    max_payload_size: int\n    task_timeout: int","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/task-runner-python/src/config/task_runner_config.py#L23-L59","documentation":"Thrown by parse_allowlist in the Python task runner when the wildcard '*' is combined with other module names in the same allowlist string. The wildcard means 'allow everything', so listing additional modules alongside it is contradictory and indicates a configuration error. This validation runs at startup when parsing any of the module allowlist environment variables.","triggerScenarios":"An allowlist environment variable (e.g. one feeding stdlib_allow or external_allow) is set to a comma-separated string containing '*' alongside other entries, like '*,os,sys' or 'requests,*. The set is built from the split string, then the check `'*' in modules and len(modules) > 1` fires.","commonSituations":"Gradually adding specific modules to an existing wildcard allowlist without removing '*'. Copy-pasting from documentation that showed both forms. Misunderstanding that '*' means 'allow all' rather than 'also allow these plus everything'.","solutions":["Use '*' alone to allow all modules: set the variable to just '*'.","Or remove '*' and list only the specific modules you need: 'os,sys,json'.","Review which allowlist variable triggered the error (the list_name in the message tells you which one).","Restart the runner after fixing the environment variable."],"exampleFix":"# before\nexport PYTHON_FUNCTION_ALLOW_EXTERNAL='*,requests,os'\n# after — option 1: allow all\nexport PYTHON_FUNCTION_ALLOW_EXTERNAL='*'\n# after — option 2: allow specific\nexport PYTHON_FUNCTION_ALLOW_EXTERNAL='requests,os'","handlingStrategy":"validation","validationCode":"def validate_allowlist(value: str, name: str) -> set[str]:\n    modules = {m.strip() for m in value.split(',') if m.strip()}\n    if '*' in modules and len(modules) > 1:\n        raise ValueError(f\"Wildcard must be alone in {name}\")\n    return modules\n\n# validate before the runner parses it\nvalidate_allowlist(os.environ.get('PYTHON_FUNCTION_ALLOW_EXTERNAL', ''), 'external_allowlist')","typeGuard":null,"tryCatchPattern":"from config.task_runner_config import ConfigurationError\n\ntry:\n    config = TaskRunnerConfig.from_env()\nexcept ConfigurationError as e:\n    if 'Wildcard' in str(e):\n        print('Fix allowlist: use * alone OR list specific modules')\n    sys.exit(1)","preventionTips":["Use '*' alone or list specific modules — never both.","Document allowlist syntax clearly in deployment guides.","Validate allowlist strings in CI before deploying."],"tags":["task-runner","python","configuration","allowlist","security"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}