{"record":{"id":"4d5085b5a13f3495","repo":"xai-org/grok-build","slug":"what-must-not-be-empty","errorCode":null,"errorMessage":"{what} must not be empty","messagePattern":"(.+?) must not be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-workspace/src/session/git.rs","lineNumber":3084,"sourceCode":"    }\n    if merge_in_progress(git_root).await? {\n        let files = git_cli(git_root, &[\"diff\", \"--name-only\", \"--diff-filter=U\"])\n            .await?\n            .lines()\n            .map(str::to_owned)\n            .collect();\n        return Ok(GitSyncBaseResult {\n            outcome: GitSyncBaseOutcome::Conflicts { files },\n        });\n    }\n    anyhow::bail!(\"merge of base ref '{base}' failed: {merge_out}\")\n}\n/// Reject a ref/branch value that could be parsed as a git option (leading `-`)\n/// or that carries whitespace/control characters or `..`. A boundary guard for\n/// client-influenced refs (notably `base_ref`) so they cannot be smuggled in as\n/// flags; combined with `--end-of-options` at each call site.\nfn ensure_ref_arg_safe(value: &str, what: &str) -> Result<()> {\n    anyhow::ensure!(!value.is_empty(), \"{what} must not be empty\");\n    anyhow::ensure!(\n        !value.starts_with('-'),\n        \"{what} '{value}' must not start with '-'\"\n    );\n    anyhow::ensure!(\n        !value.chars().any(|c| c.is_whitespace() || c.is_control()),\n        \"{what} '{value}' contains whitespace or control characters\"\n    );\n    anyhow::ensure!(\n        !value.contains(\"..\"),\n        \"{what} '{value}' must not contain '..'\"\n    );\n    Ok(())\n}\n/// Seed a committed `.gitignore` (secrets never enter git)\n/// when a fresh conversation branch is created and the repo has none. Distinct\n/// from [`seed_default_excludes`], which seeds the *local-only* `info/exclude`\n/// as a `stage_all` backstop; this file is meant to be committed, so it also","sourceCodeStart":3066,"sourceCodeEnd":3102,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-workspace/src/session/git.rs#L3066-L3102","documentation":"ensure_ref_arg_safe is a boundary guard for git ref/branch strings that come from client input (notably base_ref) before they are passed to git CLI calls. This first check rejects an empty string, since an empty ref name is never valid and could desynchronize later argument ordering. The library throws it early so a malformed ref never reaches a spawned git process.","triggerScenarios":"Calling any git operation in crates/codegen/xai-grok-workspace/src/session/git.rs that forwards a caller-supplied ref (e.g. merge_to_main, diff/base_ref operations) with an empty value for that ref, such as session_branch = \"\" or base_ref = \"\".","commonSituations":"An API caller omits the branch field and the server passes the default-constructed empty String through; a deserializer accepts missing optional field as empty string instead of rejecting it; a config file has branch= with no value.","solutions":["Provide a non-empty branch/ref name at the call site that constructs the request.","Validate or default the ref at the API/config boundary before invoking the git operation (e.g. reject empty fields with 400, or substitute the default branch).","If the ref comes from a config or env var, check it is non-empty during startup."],"exampleFix":"// before\nlet base_ref = params.base_ref.unwrap_or_default();\ngit_ops.merge_to_main(&git_root, &conv_branch, &base_ref, push).await?;\n// after\nlet base_ref = match params.base_ref {\n    Some(r) if !r.is_empty() => r,\n    _ => anyhow::bail!(\"base_ref is required and must not be empty\"),\n};","handlingStrategy":"validation","validationCode":"fn valid_ref(name: &str) -> bool { !name.is_empty() && !name.starts_with('-') && !name.contains(\"..\") && name.chars().all(|c| !c.is_whitespace() && !c.is_control()) }\nif !valid_ref(&base_ref) { return Err(\"base_ref must be a non-empty ref name\"); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make branch/ref fields required and non-empty in your request schema.","Default to the repository's default branch when the field is absent, never \"\".","Validate refs at the API boundary before they reach git operations."],"tags":["git","validation","input-validation"],"backgroundTag":"invalid-git-ref","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}