{"record":{"id":"3a6eab981bdffd97","repo":"TencentCloud/TencentDB-Agent-Memory","slug":"invalid-model-id","errorCode":null,"errorMessage":"invalid model_id","messagePattern":"invalid model_id","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"MemoryProxy/src/routes/rate-limits.ts","lineNumber":135,"sourceCode":"function readDimension(\n  body: RateLimitBody,\n): { instanceId: string; modelId: string } | Error | null {\n  const instanceId = typeof body.instance_id === \"string\" ? body.instance_id.trim() : \"\";\n  const modelId = typeof body.model_id === \"string\" ? body.model_id.trim() : \"\";\n  if (!instanceId && !modelId) return null;\n  if (!instanceId || !modelId) return new Error(\"instance_id and model_id must be provided together\");\n  try {\n    validateDimension(instanceId, modelId);\n    return { instanceId, modelId };\n  } catch (err) {\n    return err instanceof Error ? err : new Error(String(err));\n  }\n}\n\nfunction validateDimension(instanceId: string, modelId: string): void {\n  assertKeySegment(\"instance_id\", instanceId);\n  if (!modelId || modelId.length > 256 || /[\\u0000-\\u001f]/.test(modelId)) {\n    throw new Error(\"invalid model_id\");\n  }\n}\n\nfunction positiveInteger(value: unknown): number | null {\n  return typeof value === \"number\" && Number.isSafeInteger(value) && value > 0\n    ? value\n    : null;\n}\n\nfunction ok(c: Context, data: Record<string, unknown>): Response {\n  return c.json({ code: 0, message: \"ok\", data });\n}\n\nfunction error(c: Context, status: 400 | 503, message: string): Response {\n  return c.json({ code: status, message }, status);\n}\n","sourceCodeStart":117,"sourceCodeEnd":152,"githubUrl":"https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/3efcd317b84146d6a08518ac0f7ee7c8a8d200ec/MemoryProxy/src/routes/rate-limits.ts#L117-L152","documentation":"validateDimension guards the per-model rate-limit lookup endpoints: it asserts instance_id is a safe key segment and rejects model_id that is empty, longer than 256 chars, or contains control characters (U+0000–U+001F). The thrown Error('invalid model_id') is a request-validation failure, not an upstream error.","triggerScenarios":"GET /rate-limits/:instance_id/:model_id (handleGet) or readDimension with a model_id that is empty, >256 chars, or contains control characters — typically from URL-encoded junk, path traversal attempts, or a client passing a whole config blob as the model id.","commonSituations":"Client template variables left unsubstituted in the URL; log lines or multi-line strings accidentally interpolated into the path; malicious probing with control characters.","solutions":["Ensure the client passes the actual model name (e.g. 'gpt-4o') in the path segment","Trim/sanitize modelId on the caller side and reject empty values before the request","URL-encode the model id and strip control characters/whitespace before building the URL","Check for template placeholder bugs like '${modelId}' not being substituted"],"exampleFix":"// before\nconst url = `/rate-limits/${instanceId}/${rawModelId}`;\n// after\nconst modelId = String(rawModelId).trim();\nif (!modelId || modelId.length > 256 || /[\\u0000-\\u001f]/.test(modelId)) throw new Error(\"invalid model_id\");\nconst url = `/rate-limits/${encodeURIComponent(instanceId)}/${encodeURIComponent(modelId)}`;","handlingStrategy":"validation","validationCode":"function validModelId(modelId) {\n  return typeof modelId === \"string\" && modelId.length > 0 && modelId.length <= 256 && !/[\\u0000-\\u001f]/.test(modelId);\n}\nif (!validModelId(modelId)) throw new Error(\"invalid model_id\");","typeGuard":"function isValidModelId(v: unknown): v is string {\n  return typeof v === \"string\" && v.length > 0 && v.length <= 256 && !/[\\u0000-\\u001f]/.test(v);\n}","tryCatchPattern":"try {\n  await getRateLimits(instanceId, modelId);\n} catch (e) {\n  if (e.message === \"invalid model_id\") return respond400(\"model_id must be a non-empty string without control characters\");\n  throw e;\n}","preventionTips":["Sanitize and encodeURIComponent path segments before building URLs","Reject empty/template-placeholder values like '${modelId}' at the client","Cap segment length to 256 and strip control characters","Add request-shape tests covering junk path segments"],"tags":["validation","input","rate-limit","http"],"backgroundTag":"invalid-request-parameter","analyzedSha":"3efcd317b84146d6a08518ac0f7ee7c8a8d200ec","analyzedAt":"2026-09-01T05:44:22.276Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}