{"record":{"id":"559a1c09d2d99fb0","repo":"gastownhall/beads","slug":"invalid-database-name-s","errorCode":null,"errorMessage":"invalid database name: %s","messagePattern":"invalid database name: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/storage/dolt/history.go","lineNumber":37,"sourceCode":"var validDatabasePattern = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_\\-]*$`)\n\n// validateRef checks if a ref is safe to use in queries.\n// Delegates to issueops.ValidateRef.\nfunc validateRef(ref string) error {\n\treturn issueops.ValidateRef(ref)\n}\n\n// ValidateDatabaseName checks if a database name is safe to use in queries.\n// Prevents SQL injection via backtick escaping in CREATE DATABASE statements.\nfunc ValidateDatabaseName(name string) error {\n\tif name == \"\" {\n\t\treturn fmt.Errorf(\"database name cannot be empty\")\n\t}\n\tif len(name) > 64 {\n\t\treturn fmt.Errorf(\"database name too long\")\n\t}\n\tif !validDatabasePattern.MatchString(name) {\n\t\treturn fmt.Errorf(\"invalid database name: %s\", name)\n\t}\n\treturn nil\n}\n\n// validateTableName checks if a table name is safe to use in queries\nfunc validateTableName(table string) error {\n\tif table == \"\" {\n\t\treturn fmt.Errorf(\"table name cannot be empty\")\n\t}\n\tif len(table) > 64 {\n\t\treturn fmt.Errorf(\"table name too long\")\n\t}\n\tif !validTablePattern.MatchString(table) {\n\t\treturn fmt.Errorf(\"invalid table name: %s\", table)\n\t}\n\treturn nil\n}\n","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/storage/dolt/history.go#L19-L55","documentation":"ValidateDatabaseName rejects names that do not match validDatabasePattern (safe identifier characters). This is an injection guard: database names are interpolated into backtick-quoted CREATE DATABASE statements, and characters that could break out of backtick escaping are disallowed. The offending name is included in the message.","triggerScenarios":"Passing BootstrapFromRemoteWithDB or openServerConnection a database name containing characters outside the allowed identifier set — e.g. backticks, quotes, spaces, slashes, hyphens in positions the pattern rejects, or non-ASCII characters.","commonSituations":"Using an org/repo string like 'myorg/myrepo' or 'my repo' as a database name; names with URL-encoded characters or trailing whitespace from config files; programmatic name generation inserting separators like ':' or '#'.","solutions":["Sanitize the database name to match the allowed identifier pattern (alphanumerics/underscores, no backticks, quotes, spaces or path separators).","If the name comes from a repo slug, replace '/' and other separators with '_' before calling bootstrap/connect.","Trim whitespace from configuration/env-sourced values; re-read the config to confirm the intended short name is used, not a URL."],"exampleFix":"// before\ndbName := strings.TrimPrefix(remote, \"https://doltremoteapi.dolthub.com/\") // \"org/repo\"\nstore, err := dolt.BootstrapFromRemoteWithDB(ctx, remote, dbName)\n// after\ndbName := strings.ReplaceAll(strings.TrimPrefix(remote, \"https://doltremoteapi.dolthub.com/\"), \"/\", \"_\") // \"org_repo\"\nstore, err := dolt.BootstrapFromRemoteWithDB(ctx, remote, dbName)","handlingStrategy":"validation","validationCode":"var dbPattern = regexp.MustCompile(`^[A-Za-z0-9_]+$`)\nfunc validDBName(name string) bool { return dbPattern.MatchString(name) }\nif !validDBName(dbName) { return fmt.Errorf(\"db name %q contains invalid characters\", dbName) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never pass raw URLs or org/repo slugs as database names; normalize separators to '_' first.","Trim whitespace from config/env-sourced values before use.","Treat identifiers as untrusted input — validate against a strict allowlist pattern everywhere they are constructed."],"tags":["database","validation","sql-injection-prevention","dolt"],"backgroundTag":"invalid-identifier-name","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}