{"record":{"id":"234f4d667bc5095c","repo":"hasura/graphql-engine","slug":"the-plugin-name-q-is-not-allowed-must-match-q","errorCode":null,"errorMessage":"the plugin name %q is not allowed, must match %q","messagePattern":"the plugin name %q is not allowed, must match %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/plugins/types.go","lineNumber":124,"sourceCode":"func (p *Plugin) ParseVersion() {\n\tv, err := semver.NewVersion(p.Version)\n\tif err != nil {\n\t\tp.ParsedVersion = semver.MustParse(\"0.0.0-dev\")\n\n\t\treturn\n\t}\n\n\tp.ParsedVersion = v\n}\n\n// ValidatePlugin checks for structural validity of the Plugin object with given\n// name.\nfunc (p Plugin) ValidatePlugin(name string) error {\n\tvar op errors.Op = \"plugins.Plugin.ValidatePlugin\"\n\tif !IsSafePluginName(name) {\n\t\treturn errors.E(\n\t\t\top,\n\t\t\tfmt.Errorf(\n\t\t\t\t\"the plugin name %q is not allowed, must match %q\",\n\t\t\t\tname,\n\t\t\t\tsafePluginRegexp.String(),\n\t\t\t),\n\t\t)\n\t}\n\n\tif p.Name != name {\n\t\treturn errors.E(op, fmt.Errorf(\"plugin should be named %q, not %q\", name, p.Name))\n\t}\n\n\tif p.ShortDescription == \"\" {\n\t\treturn errors.E(op, \"should have a short description\")\n\t}\n\n\tif strings.ContainsAny(p.ShortDescription, \"\\r\\n\") {\n\t\treturn errors.E(op, \"should not have line breaks in short description\")\n\t}","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/cli/plugins/types.go#L106-L142","documentation":"ValidatePlugin rejects a plugin whose name does not satisfy the safe plugin name regexp. The library only accepts names matching a restricted pattern (defined by safePluginRegexp in cli/plugins/types.go) to avoid path traversal and unsafe characters when the name is later turned into binaries and symlinks. The error echoes the offending name and the exact regexp that must be matched.","triggerScenarios":"Calling ReadPluginFromFile (which calls Plugin.ValidatePlugin(name)) with a name containing characters outside safePluginRegexp — e.g. names with spaces, slashes, leading digits, or uppercase letters, depending on the pattern (typically ^[a-z][a-z0-9_-]*$ style).","commonSituations":"Manifest files named like 'My Plugin.json', names with dots or slashes, or names differing in case from what the registry expects. Also happens when the filename passed to ReadPluginFromFile derives from user input that was never sanitized.","solutions":["Rename the plugin to match safePluginRegexp.String() (shown verbatim in the error message) — typically lowercase letters, digits, hyphens/underscores, starting with a letter.","Check the file name / argument you pass to ReadPluginFromFile; it must equal the sanitized plugin name.","Sanitize user-supplied names before invoking the API."],"exampleFix":"// before\nerr := p.ValidatePlugin(\"My Cool Plugin\")\n\n// after\nerr := p.ValidatePlugin(\"my-cool-plugin\")","handlingStrategy":"validation","validationCode":"var safeName = regexp.MustCompile(`^[a-z][a-z0-9_-]*$`) // mirror safePluginRegexp\n\nfunc assertSafeName(name string) error {\n\tif !safeName.MatchString(name) {\n\t\treturn fmt.Errorf(\"name %q must match %s\", name, safeName.String())\n\t}\n\treturn nil\n}","typeGuard":"func isSafePluginName(name string) bool {\n\treturn safeName.MatchString(name)\n}","tryCatchPattern":"if err := p.ValidatePlugin(name); err != nil {\n\tvar opErr errors.Error\n\tif errors.As(err, &opErr) && strings.Contains(err.Error(), \"not allowed\") {\n\t\t// sanitize or reject the name before retrying\n\t}\n\treturn err\n}","preventionTips":["Validate plugin names against safePluginRegexp before calling ReadPluginFromFile.","Derive the plugin name from trusted constants, not raw user input.","Add a unit test asserting your plugin names match the pattern."],"tags":["plugins","validation","naming","manifest"],"backgroundTag":"name-validation-failed","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}