{"record":{"id":"20eff906d65d345e","repo":"Tencent/WeKnora","slug":"weknora-redis-namespace-must-not-contain-braces","errorCode":null,"errorMessage":"WEKNORA_REDIS_NAMESPACE must not contain braces","messagePattern":"WEKNORA_REDIS_NAMESPACE must not contain braces","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/session_binding_redis.go","lineNumber":405,"sourceCode":"\nfunc (s *RedisSessionSandboxBindingStore) lockKey(key SessionSandboxKey) string {\n\t// Keep the historical suffix used by the saved multi-node Cube\n\t// implementation so rolling upgrades serialize on the same lock.\n\treturn \"weknora:sandbox:session:{\" + s.hashTag(key) + \"}:create-lock\"\n}\n\nfunc (s *RedisSessionSandboxBindingStore) hashTag(key SessionSandboxKey) string {\n\treturn fmt.Sprintf(\"%s:%d:%s\", s.namespace, key.TenantID, key.SessionID)\n}\n\nvar (\n\t_ tenantBindingScanner  = (*RedisSessionSandboxBindingStore)(nil)\n\t_ sessionTurnLeaseStore = (*RedisSessionSandboxBindingStore)(nil)\n)\n\nfunc validateRedisNamespace(namespace string) error {\n\tif strings.ContainsAny(namespace, \"{}\") {\n\t\treturn errors.New(\"WEKNORA_REDIS_NAMESPACE must not contain braces\")\n\t}\n\tfor _, r := range namespace {\n\t\tif unicode.IsControl(r) {\n\t\t\treturn errors.New(\"WEKNORA_REDIS_NAMESPACE must not contain control characters\")\n\t\t}\n\t}\n\treturn nil\n}\n","sourceCodeStart":387,"sourceCodeEnd":414,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/session_binding_redis.go#L387-L414","documentation":"validateRedisNamespace rejects a WEKNORA_REDIS_NAMESPACE containing '{' or '}'. Braces are reserved by Redis Cluster key hashing ({...} defines hash tags), so allowing them in the namespace could break key distribution; NewRedisSessionSandboxBindingStore refuses to start with such a namespace.","triggerScenarios":"Starting the service with WEKNORA_REDIS_NAMESPACE containing '{' or '}' in the environment, failing NewRedisSessionSandboxBindingStore.","commonSituations":"Operator copies a Redis Cluster hash-tagged key pattern into the namespace env var; template placeholders like '{tenant}' left unexpanded in deployment config.","solutions":["Remove braces from WEKNORA_REDIS_NAMESPACE (use plain prefixes like 'weknora:sandbox:').","Expand any template placeholders in deployment config so a literal '{...}' never reaches the env var.","Validate the value at deploy time (echo \"$WEKNORA_REDIS_NAMESPACE\") before startup."],"exampleFix":"// before (deployment env)\nWEKNORA_REDIS_NAMESPACE=weknora:{tenant}:sandbox\n// after\nWEKNORA_REDIS_NAMESPACE=weknora.sandbox","handlingStrategy":"validation","validationCode":"if ns := os.Getenv(\"WEKNORA_REDIS_NAMESPACE\"); strings.ContainsAny(ns, \"{}\") {\n    return fmt.Errorf(\"WEKNORA_REDIS_NAMESPACE must not contain braces: %q\", ns)\n}","typeGuard":null,"tryCatchPattern":"store, err := sandbox.NewRedisSessionSandboxBindingStore(client, ns)\nif err != nil {\n    return fmt.Errorf(\"redis namespace %q rejected: %w\", ns, err)\n}","preventionTips":["Keep namespaces to [A-Za-z0-9.:_-] only.","Expand deployment templates before they reach env vars.","Validate env vars in a startup preflight check."],"tags":["go","sandbox","redis","configuration","env-var"],"backgroundTag":"invalid-env-var","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}