{"record":{"id":"2976f139e8f15c0c","repo":"docker/cli","slug":"invalid-port-w","errorCode":null,"errorMessage":"invalid port: %w","messagePattern":"invalid port: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/connhelper/ssh/ssh.go","lineNumber":120,"sourceCode":"\nfunc (sp *Spec) args(sshFlags ...string) ([]string, error) {\n\tvar args []string\n\tif sp.Host == \"\" {\n\t\treturn nil, errors.New(\"no host specified\")\n\t}\n\tif sp.User != \"\" {\n\t\t// Quote user, as it's obtained from the URL.\n\t\tusr, err := syntax.Quote(sp.User, syntax.LangPOSIX)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid user: %w\", err)\n\t\t}\n\t\targs = append(args, \"-l\", usr)\n\t}\n\tif sp.Port != \"\" {\n\t\t// Quote port, as it's obtained from the URL.\n\t\tport, err := syntax.Quote(sp.Port, syntax.LangPOSIX)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid port: %w\", err)\n\t\t}\n\t\targs = append(args, \"-p\", port)\n\t}\n\n\t// We consider \"sshFlags\" to be \"trusted\", and set from code only,\n\t// as they are not parsed from the DOCKER_HOST URL.\n\targs = append(args, sshFlags...)\n\n\thost, err := syntax.Quote(sp.Host, syntax.LangPOSIX)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid host: %w\", err)\n\t}\n\n\treturn append(args, \"--\", host), nil\n}\n\n// Command returns the ssh flags and arguments to execute a command\n// (remoteCommandAndArgs) on the remote host. Where needed, it quotes","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/connhelper/ssh/ssh.go#L102-L138","documentation":"Raised in Spec.args (ssh.go:118-120) when the port portion of the ssh URL cannot be POSIX-shell-quoted by syntax.Quote. The port is taken from u.Port() and passed to ssh's `-p` flag; if it contains bytes the quoting library rejects, this wraps the error.","triggerScenarios":"Spec.args/Args/Command is called after building a Spec from a URL whose Port field (the part after `:` in the authority) contains characters syntax.Quote cannot handle, such as a NUL or non-printable control character.","commonSituations":"A DOCKER_HOST ssh URL with a port like `ssh://user@host:22\\x00` where a stray control byte leaked in from a misconfigured env var or script. Rare; normally the port is a clean integer.","solutions":["Inspect the port segment of the DOCKER_HOST URL for hidden/control characters.","Set the port to a plain numeric value (1–65535).","Re-export DOCKER_HOST and retest."],"exampleFix":"# before — control char in port\nexport DOCKER_HOST='ssh://user@host:22<x00>'\n# after\nexport DOCKER_HOST='ssh://user@host:22'","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(daemonURL)\nif port := u.Port(); port != \"\" {\n    n, err := strconv.Atoi(port)\n    if err != nil || n < 1 || n > 65535 {\n        return errors.New(\"ssh URL port must be a number 1-65535\")\n    }\n}","typeGuard":null,"tryCatchPattern":"args, err := spec.Args(remote...)\nif err != nil {\n    return fmt.Errorf(\"cannot build ssh args (bad port?): %w\", err)\n}","preventionTips":["Only use numeric ports in the DOCKER_HOST ssh URL.","Sanitize env-sourced URL values for control characters.","Validate DOCKER_HOST in a startup check."],"tags":["connhelper","ssh","url","port","quoting","shell-injection"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}