{"record":{"id":"384c855ee35525a8","repo":"Tencent/WeKnora","slug":"environment-variable-s-value-exceeds-maximum-le","errorCode":null,"errorMessage":"environment variable '%s' value exceeds maximum length","messagePattern":"environment variable '(.+?)' value exceeds maximum length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":609,"sourceCode":"\t\treturn nil\n\t}\n\n\tfor key, value := range envVars {\n\t\t// Check key against dangerous patterns\n\t\tfor _, pattern := range DangerousEnvVarPatterns {\n\t\t\tif pattern.MatchString(key) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' is not allowed for security reasons\", key)\n\t\t\t}\n\t\t}\n\n\t\t// Check key length\n\t\tif len(key) > 256 {\n\t\t\treturn fmt.Errorf(\"environment variable name '%s' exceeds maximum length\", SanitizeForLog(key[:50]))\n\t\t}\n\n\t\t// Check value length\n\t\tif len(value) > 4096 {\n\t\t\treturn fmt.Errorf(\"environment variable '%s' value exceeds maximum length\", key)\n\t\t}\n\n\t\t// Check for null bytes in value\n\t\tif strings.Contains(value, \"\\x00\") {\n\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains null bytes\", key)\n\t\t}\n\n\t\t// Check value for shell injection patterns\n\t\tfor _, pattern := range DangerousArgPatterns {\n\t\t\tif pattern.MatchString(value) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains potentially dangerous pattern\", key)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":591,"sourceCodeEnd":627,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L591-L627","documentation":"ValidateStdioEnvVars limits each environment-variable VALUE to 4096 characters. Values longer than this are rejected to prevent oversized environments that could exhaust process limits or hide injection payloads.","triggerScenarios":"ValidateStdioConfig called with an env map where some value exceeds 4096 bytes — e.g. a giant token, embedded JSON blob, certificate, or concatenated secrets.","commonSituations":"Embedding service-account JSON or PEM certificates directly in env values; very long JWTs or connection strings; configs that concatenate multiple values into one variable.","solutions":["Move the large value to a file and pass the file path as the env value","Compress/encode only if that reduces size below 4096 chars, or split across multiple smaller variables if the server supports it","Use a secrets manager / mounted secret file rather than an inline env value","Trim the value to only what the server actually needs (e.g. a key id + secret instead of full JSON)"],"exampleFix":"// before\n\"env\": {\"GOOGLE_APPLICATION_CREDENTIALS_JSON\": \"<5000-char service account JSON>\"}\n// after\n\"env\": {\"GOOGLE_APPLICATION_CREDENTIALS\": \"/path/to/sa.json\"}","handlingStrategy":"validation","validationCode":"for k, v := range cfg.Env {\n    if len(v) > 4096 {\n        return fmt.Errorf(\"env %s value too long (%d > 4096); use a file path instead\", k, len(v))\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := ValidateStdioConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"value exceeds maximum length\") {\n        return fmt.Errorf(\"move large secret/config to a file and reference its path: %w\", err)\n    }\n    return err\n}","preventionTips":["Reference secrets by file path instead of inlining JSON/PEM blobs in env values","Use a secrets manager or mounted secret files for large credentials","Pre-check env value lengths before writing MCP configs"],"tags":["validation","env-vars","mcp","stdio","limits"],"backgroundTag":"env-var-value-too-long","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}