{"record":{"id":"4b8302a18d329288","repo":"phacility/phabricator","slug":"invalid-request-csrf","errorCode":null,"errorMessage":"Invalid Request (CSRF)","messagePattern":"Invalid Request \\(CSRF\\)","errorType":"exception","errorClass":"AphrontMalformedRequestException","httpStatus":500,"severity":"error","filePath":"src/aphront/AphrontRequest.php","lineNumber":403,"sourceCode":"          \"this only for writes which can not be protected with normal CSRF \".\n          \"mechanisms.\\n\\n\".\n          \"Some UI elements (like %s) also have methods which will allow you \".\n          \"to render links as forms (like %s).\",\n          'phabricator_form()',\n          'phabricator_form()',\n          '/',\n          'AphrontWriteGuard::beginScopedUnguardedWrites()',\n          'PhabricatorActionListView',\n          'setRenderAsForm(true)');\n      }\n\n      $message = implode(\"\\n\", $info);\n\n      // This should only be able to happen if you load a form, pull your\n      // internet for 6 hours, and then reconnect and immediately submit,\n      // but give the user some indication of what happened since the workflow\n      // is incredibly confusing otherwise.\n      throw new AphrontMalformedRequestException(\n        pht('Invalid Request (CSRF)'),\n        $message,\n        true);\n    }\n\n    return true;\n  }\n\n  public function isFormPost() {\n    $post = $this->getExists(self::TYPE_FORM) &&\n            !$this->getExists(self::TYPE_HISEC) &&\n            $this->isHTTPPost();\n\n    if (!$post) {\n      return false;\n    }\n\n    return $this->validateCSRF();","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/aphront/AphrontRequest.php#L385-L421","documentation":"Thrown by 'bin/repository thaw' when repository arguments were given but the loader resolved zero repositories for them. In practice this branch is nearly unreachable because loadRepositories() throws 'Repository \"%s\" does not exist!' for any identifier it cannot resolve; it exists as a defensive backstop for the case where the wildcard argument list yields a non-empty argument array that still maps to no repositories (for example degenerate/empty-string arguments surviving the parser).","triggerScenarios":"Passing argument tokens that the parser records as a truthy list but that resolve to no repository objects, e.g. 'bin/repository thaw --demote dev-1 \"\"' in parser edge cases; $repository_names is truthy, loadRepositories() returns an empty array without throwing, and the 'if (!$repositories)' guard at PhabricatorRepositoryManagementThawWorkflow.php:130 fires.","commonSituations":"Wrapper scripts passing an unquoted empty variable that still expands to a token; automation building the repo list from a query that returned nothing and passing a placeholder instead of failing earlier.","solutions":["Verify the repository identifiers with 'bin/repository list R...' or the UI before running thaw.","Make wrapper scripts fail early when the computed repository list is empty instead of invoking thaw with placeholders.","Re-run with explicit, known-good monikers such as 'R123' or a callsign."],"exampleFix":"# before (REPOS expands to a degenerate token)\nbin/repository thaw --demote dev-1 $REPOS\n\n# after (guard in the wrapper script)\ntest -n \"$REPOS\" || { echo 'no repositories selected' >&2; exit 1; }\nbin/repository thaw --demote dev-1 $REPOS","handlingStrategy":"validation","validationCode":"# Verify identifiers resolve before thaw:\nfor r in $REPOS; do\n  bin/repository list \"$r\" >/dev/null || exit 1\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the computed repo list is non-empty and each identifier resolves before running destructive tools.","Prefer explicit monikers over empty placeholder arguments."],"tags":["phabricator","cli","empty-result","repository-management","defensive-check"],"backgroundTag":"empty-argument-list","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}