{"record":{"id":"2956a68ce3aadc63","repo":"jackwener/OpenCLI","slug":"osv-vulnerability-id-value-is-not-a-valid-osv","errorCode":null,"errorMessage":"osv vulnerability id \"${value}\" is not a valid OSV id","messagePattern":"osv vulnerability id \"(.+?)\" is not a valid OSV id","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"clis/osv/utils.js","lineNumber":49,"sourceCode":"    'SwiftURL',\n]);\n\nexport function requireString(value, label) {\n    const s = String(value ?? '').trim();\n    if (!s) throw new ArgumentError(`osv ${label} cannot be empty`);\n    return s;\n}\n\nexport function requireVulnId(value) {\n    const s = String(value ?? '').trim();\n    if (!s) {\n        throw new ArgumentError(\n            'osv vulnerability id is required (e.g. \"GHSA-29mw-wpgm-hmr9\", \"CVE-2020-28500\")',\n            'IDs are listed at https://osv.dev — paste the canonical id from the vulnerability page.',\n        );\n    }\n    if (!VULN_ID.test(s)) {\n        throw new ArgumentError(\n            `osv vulnerability id \"${value}\" is not a valid OSV id`,\n            'IDs are short ASCII tokens like \"GHSA-...\", \"CVE-...\", \"PYSEC-...\".',\n        );\n    }\n    return s;\n}\n\nexport function requireEcosystem(value) {\n    const s = String(value ?? '').trim();\n    if (!s) {\n        throw new ArgumentError(\n            'osv --ecosystem is required when querying by package',\n            `Pick one of: ${[...OSV_ECOSYSTEMS].join(', ')}.`,\n        );\n    }\n    if (!OSV_ECOSYSTEMS.has(s)) {\n        throw new ArgumentError(\n            `osv --ecosystem \"${value}\" is not a recognised OSV ecosystem`,","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/osv/utils.js#L31-L67","documentation":"After the non-empty check, requireVulnId validates the value against VULN_ID (an ASCII token of 1-80 chars starting alphanumeric). Values containing spaces, slashes, URLs, or other non-token characters are rejected as not valid OSV ids.","triggerScenarios":"Passing something like a full advisory URL (https://osv.dev/vulnerability/GHSA-...), an ID with a typo or trailing whitespace/quotes, or a non-OSV identifier format.","commonSituations":"Pasting the whole osv.dev URL instead of just the ID; copying an ID with trailing punctuation from a PDF/chat; using an internal ticket ID rather than a GHSA/CVE/PYSEC id.","solutions":["Extract just the ID token from the URL (the last path segment).","Strip surrounding quotes, spaces, and punctuation from the pasted value.","Use a recognized format: GHSA-xxxx-xxxx-xxxx, CVE-YYYY-NNNN, PYSEC-YYYY-NN, etc.","Confirm the ID exists at https://osv.dev."],"exampleFix":"// before\nrequireVulnId('https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9');\n// after\nrequireVulnId('GHSA-29mw-wpgm-hmr9');","handlingStrategy":"validation","validationCode":"const VULN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;\nif (!VULN_ID_RE.test(String(vulnId ?? '').trim())) {\n  throw new Error(`\"${vulnId}\" is not a valid OSV id (expected GHSA-..., CVE-..., PYSEC-...)`);\n}","typeGuard":"const isValidOsvId = (v) =>\n  typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(v.trim());","tryCatchPattern":"try {\n  const vuln = await osvVuln(id);\n} catch (e) {\n  if (e instanceof ArgumentError && /not a valid OSV id/.test(e.message)) {\n    console.error(`Invalid id \"${id}\" — extract the bare token, e.g. GHSA-29mw-wpgm-hmr9`);\n    return;\n  }\n  throw e;\n}","preventionTips":["Strip URLs down to the final path segment before lookup.","Trim whitespace and surrounding quotes from pasted IDs.","Validate IDs with the same regex the library uses before calling.","Keep a mapping of advisory URLs → canonical IDs in tooling."],"tags":["input-validation","format-validation","osv"],"backgroundTag":"invalid-identifier-format","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}