{"record":{"id":"247f46bf2f539c0a","repo":"larksuite/cli","slug":"s-contains-invalid-characters","errorCode":null,"errorMessage":"%s contains invalid characters","messagePattern":"(.+?) contains invalid characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/validate/resource.go","lineNumber":37,"sourceCode":"// ResourceName validates an API resource identifier (messageId, fileToken, etc.)\n// before it is interpolated into a URL path via fmt.Sprintf. It rejects path\n// traversal (..), URL metacharacters (?#%), percent-encoded bypasses (%2e%2e),\n// control characters, and dangerous Unicode.\n//\n// Without this check, an input like \"../admin\" or \"?evil=true\" in a message ID\n// would alter the API endpoint the request is sent to. Works alongside\n// EncodePathSegment for defense-in-depth.\nfunc ResourceName(name, flagName string) error {\n\tif name == \"\" {\n\t\treturn fmt.Errorf(\"%s must not be empty\", flagName)\n\t}\n\tfor _, seg := range strings.Split(name, \"/\") {\n\t\tif seg == \"..\" {\n\t\t\treturn fmt.Errorf(\"%s must not contain '..' path traversal\", flagName)\n\t\t}\n\t}\n\tif unsafeResourceChars.MatchString(name) {\n\t\treturn fmt.Errorf(\"%s contains invalid characters\", flagName)\n\t}\n\tfor _, r := range name {\n\t\tif charcheck.IsDangerousUnicode(r) {\n\t\t\treturn fmt.Errorf(\"%s contains dangerous Unicode characters\", flagName)\n\t\t}\n\t}\n\treturn nil\n}\n\n// EncodePathSegment percent-encodes user input for safe use as a single URL path\n// segment (e.g. / → %2F, ? → %3F, # → %23), ensuring the value cannot alter the\n// URL routing structure when interpolated into an API path.\n//\n// This provides defense-in-depth alongside ResourceName: ResourceName rejects known\n// dangerous patterns at the input layer, while EncodePathSegment acts as a fallback\n// at the concatenation layer — if ResourceName rules are relaxed in the future, or\n// if an API path bypasses ResourceName validation (e.g. cmd/service/ generic calls),\n// encoding still prevents special characters from being interpreted as path separators","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/validate/resource.go#L19-L55","documentation":"ResourceName checks the identifier against the unsafeResourceChars pattern and rejects it if any disallowed character is present. This prevents characters that could alter URL structure or request semantics (e.g. '?', '#') from reaching the endpoint. The message names the offending flag.","triggerScenarios":"validate.ResourceName receives a name matching unsafeResourceChars — URL-significant characters like '?', '#', or whitespace/control characters in an ID flag.","commonSituations":"Copying IDs including surrounding URL fragments or query strings, trailing whitespace from copy-paste, spaces introduced by shell word splitting, or injection attempts via '?evil=true'-style input.","solutions":["Trim whitespace and copy only the exact identifier token.","Remove URL fragments/query parts if the ID was copied from a full URL.","Quote variables in shell to avoid stray characters from word splitting.","Use EncodePathSegment if the input legitimately needs URL-unsafe characters."],"exampleFix":"// before\nlark-cli im message get --message-id \"om_abc?trace=1\"\n// after\nlark-cli im message get --message-id \"om_abc\"","handlingStrategy":"validation","validationCode":"id = strings.TrimSpace(id)\nif strings.ContainsAny(id, \"?# \\t\") {\n    return fmt.Errorf(\"id contains URL-significant or whitespace characters\")\n}","typeGuard":null,"tryCatchPattern":"if err := validate.ResourceName(id, \"--message-id\"); err != nil {\n    return fmt.Errorf(\"clean the id (no query/fragment chars): %w\", err)\n}","preventionTips":["Trim whitespace from all CLI inputs.","Copy IDs as bare tokens, never full URLs with query strings or fragments.","Quote shell variables to prevent word-splitting artifacts.","Run validate.ResourceName (or equivalent) in your own tooling before shelling out."],"tags":["input-validation","security","cli-flags"],"backgroundTag":"invalid-characters-in-input","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}