{"record":{"id":"21439f3a95924814","repo":"golang/go","slug":"invalid-package-directory-q","errorCode":null,"errorMessage":"invalid package directory %q","messagePattern":"invalid package directory %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/load/pkg.go","lineNumber":2052,"sourceCode":"\t// If first letter of input file is ASCII, it must be alphanumeric.\n\t// This avoids files turning into flags when invoking commands,\n\t// and other problems we haven't thought of yet.\n\t// Also, _cgo_ files must be generated by us, not supplied.\n\t// They are allowed to have //go:cgo_ldflag directives.\n\t// The directory scan ignores files beginning with _,\n\t// so we shouldn't see any _cgo_ files anyway, but just be safe.\n\tfor _, file := range inputs {\n\t\tif !SafeArg(file) || strings.HasPrefix(file, \"_cgo_\") {\n\t\t\tsetError(fmt.Errorf(\"invalid input file name %q\", file))\n\t\t\treturn\n\t\t}\n\t}\n\tif name := pathpkg.Base(p.ImportPath); !SafeArg(name) {\n\t\tsetError(fmt.Errorf(\"invalid input directory name %q\", name))\n\t\treturn\n\t}\n\tif strings.ContainsAny(p.Dir, \"\\r\\n\") {\n\t\tsetError(fmt.Errorf(\"invalid package directory %q\", p.Dir))\n\t\treturn\n\t}\n\n\t// Build list of imported packages and full dependency list.\n\timports := make([]*Package, 0, len(p.Imports))\n\tfor i, path := range importPaths {\n\t\tif path == \"C\" {\n\t\t\tcontinue\n\t\t}\n\t\tp1, err := loadImport(ld, ctx, opts, nil, path, p.Dir, p, stk, p.Internal.Build.ImportPos[path], ResolveImport|allowInternalSimdImport)\n\t\tif err != nil && p.Error == nil {\n\t\t\tp.Error = err\n\t\t\tp.Incomplete = true\n\t\t}\n\n\t\tpath = p1.ImportPath\n\t\timportPaths[i] = path\n\t\tif i < len(p.Imports) {","sourceCodeStart":2034,"sourceCodeEnd":2070,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/load/pkg.go#L2034-L2070","documentation":"The package directory path (p.Dir) contains a carriage return ('\\r') or newline ('\\n') character. These control characters would break command-line construction and build scripts that pass the directory as an argument, so the toolchain rejects them outright via strings.ContainsAny(p.Dir, \"\\r\\n\").","triggerScenarios":"A filesystem path with embedded '\\r' or '\\n' in any directory component. This can occur through unusual directory creation, corrupted file listings, or paths constructed from untrusted or poorly-sanitized input that includes line terminators.","commonSituations":"Paths constructed programmatically from text processing that accidentally include newline characters. Directory names containing hidden control characters from copy-paste operations (especially from web pages or PDFs). Paths from external tools or build scripts that embed control characters. Shell injection artifacts.","solutions":["Rename the directory to remove any '\\r' or '\\n' characters.","If the path was set via a build script or environment variable, sanitize it to strip control characters.","Check for hidden characters: use 'ls -la', 'od -c', or 'xxd' on the directory path.","Audit build scripts for unsanitized user input in path construction."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate that a directory path contains no control characters.\nfunc validatePackageDir(dir string) error {\n    if strings.ContainsAny(dir, \"\\r\\n\") {\n        return fmt.Errorf(\"package directory %q contains control characters (CR or LF)\", dir)\n    }\n    return nil\n}","typeGuard":"// Check whether a path is safe for use as a package directory.\nfunc isSafeDirPath(dir string) bool {\n    return !strings.ContainsAny(dir, \"\\r\\n\")\n}","tryCatchPattern":null,"preventionTips":["Sanitize all paths constructed from user input or external data to remove control characters.","Audit build scripts for unsanitized environment variables in path construction.","Check directory names with od -c or xxd if hidden characters are suspected."],"tags":["go","go-build","filesystem","validation","path-sanitization","security"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}