{"record":{"id":"4c13dcd61e7c4617","repo":"Tencent/WeKnora","slug":"argument-d-contains-potentially-dangerous-pattern","errorCode":null,"errorMessage":"argument %d contains potentially dangerous pattern: %s","messagePattern":"argument (.+?) contains potentially dangerous pattern: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":574,"sourceCode":"}\n\n// ValidateStdioArgs validates the arguments for MCP stdio transport\n// Returns an error if any argument contains dangerous patterns\nfunc ValidateStdioArgs(args []string) error {\n\tif len(args) == 0 {\n\t\treturn nil\n\t}\n\n\tfor i, arg := range args {\n\t\t// Check length\n\t\tif len(arg) > 1024 {\n\t\t\treturn fmt.Errorf(\"argument %d exceeds maximum length (1024 characters)\", i)\n\t\t}\n\n\t\t// Check against dangerous patterns\n\t\tfor _, pattern := range DangerousArgPatterns {\n\t\t\tif pattern.MatchString(arg) {\n\t\t\t\treturn fmt.Errorf(\"argument %d contains potentially dangerous pattern: %s\", i, SanitizeForLog(arg))\n\t\t\t}\n\t\t}\n\n\t\t// Check for null bytes\n\t\tif strings.Contains(arg, \"\\x00\") {\n\t\t\treturn fmt.Errorf(\"argument %d contains null bytes\", i)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// ValidateStdioEnvVars validates environment variables for MCP stdio transport\n// Returns an error if any env var name or value is dangerous\nfunc ValidateStdioEnvVars(envVars map[string]string) error {\n\tif len(envVars) == 0 {\n\t\treturn nil\n\t}","sourceCodeStart":556,"sourceCodeEnd":592,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L556-L592","documentation":"ValidateStdioArgs checks each argument against a list of DangerousArgPatterns regexes (shell metacharacters, injection patterns, etc.). If an argument matches any pattern it is rejected, with the argument echoed through SanitizeForLog to avoid log injection. This guards against arguments that could enable command injection when the process is spawned.","triggerScenarios":"An args element matching a dangerous regex, e.g. containing backticks, $(), ; && |, redirect operators, or other configured shell-injection signatures.","commonSituations":"Passing user-supplied filter expressions or URLs that contain shell metacharacters; arguments built by string concatenation of user input; legitimate flags like \"--foo|bar\" or package specifiers with special characters.","solutions":["Remove or escape the dangerous characters from the argument; pass values as single argv entries without shell interpretation","If the pattern is a false positive (e.g. a legitimate package spec like \"foo@1.0|bar\"), restructure the value (use quotes in the underlying tool's own syntax, or a config file) rather than embedding shell syntax","Review DangerousArgPatterns in internal/utils/security.go to see which regex matched and adjust the argument accordingly","Pass complex inputs via a file or environment variable instead of the command line"],"exampleFix":"// before\n\"args\": [\"--query\", \"name; rm -rf /\"]\n// after\n\"args\": [\"--query\", \"name\"] // user input sanitized before building args","handlingStrategy":"validation","validationCode":"var dangerous = regexp.MustCompile(`[;&|`'$()<>]`)\nfor i, a := range cfg.Args {\n    if dangerous.MatchString(a) {\n        return fmt.Errorf(\"args[%d] contains shell metacharacters\", i)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := ValidateStdioConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"dangerous pattern\") {\n        return fmt.Errorf(\"sanitize argument before use: %w\", err)\n    }\n    return err\n}","preventionTips":["Treat all user input as unsafe before placing it in argv","Avoid shell metacharacters in arguments; stdio spawn uses argv directly but the target tool may re-interpret values","Pass complex inputs via config files or env vars","Review DangerousArgPatterns to know what is blocked"],"tags":["security","injection","mcp","stdio","args"],"backgroundTag":"dangerous-command-argument","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}