{"record":{"id":"57d0e52869240504","repo":"abpframework/abp","slug":"invalid-npm-package-name-detected-sanitizeforlog","errorCode":null,"errorMessage":"Invalid npm package name detected: {SanitizeForLog(packageName)}","messagePattern":"Invalid npm package name detected: (.+?)","errorType":"exception","errorClass":"CliUsageException","httpStatus":null,"severity":"error","filePath":"framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/Utils/NpmHelper.cs","lineNumber":95,"sourceCode":"        EnsureSafePackageName(package);\n        EnsureSafeVersion(version);\n        var packageVersion = !string.IsNullOrWhiteSpace(version) ? $\"@{version}\" : string.Empty;\n        CmdHelper.RunCmd(\"npx yarn add \" + package + packageVersion + \" --ignore-scripts\", workingDirectory: directory);\n    }\n\n    private static readonly Regex SafePackageNameRegex = new(\n        @\"^(@[a-zA-Z0-9][a-zA-Z0-9._-]*/)?[a-zA-Z0-9][a-zA-Z0-9._-]*$\",\n        RegexOptions.Compiled);\n\n    private static readonly Regex SafeVersionRegex = new(\n        @\"^[a-zA-Z0-9._~^+\\-]+$\",\n        RegexOptions.Compiled);\n\n    public static void EnsureSafePackageName(string packageName)\n    {\n        if (string.IsNullOrWhiteSpace(packageName) || !SafePackageNameRegex.IsMatch(packageName))\n        {\n            throw new CliUsageException($\"Invalid npm package name detected: {SanitizeForLog(packageName)}\");\n        }\n    }\n\n    public static void EnsureSafeVersion(string version)\n    {\n        if (!string.IsNullOrWhiteSpace(version) && !SafeVersionRegex.IsMatch(version))\n        {\n            throw new CliUsageException($\"Invalid npm package version detected: {SanitizeForLog(version)}\");\n        }\n    }\n\n    public static string SanitizeForLog(string value)\n    {\n        if (value == null)\n        {\n            return \"(null)\";\n        }\n","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/abpframework/abp/blob/7ed43b1931b9df46a50c0c59148a18645641d0df/framework/src/Volo.Abp.Cli.Core/Volo/Abp/Cli/Utils/NpmHelper.cs#L77-L113","documentation":"Thrown by NpmHelper.EnsureSafePackageName as a command-injection guard before a package name is interpolated into an npm/npx shell command. The SafePackageNameRegex requires an npm-style name: an optional @scope/ segment followed by a package identifier, allowing only alphanumerics, dots, underscores, and hyphens. Null, empty, whitespace, or any character outside the allowed set (spaces, semicolons, pipes, quotes, etc.) triggers the exception.","triggerScenarios":"Calling NpmInstallPackage / YarnAddPackage with a packageName that contains shell metacharacters, spaces, or is null/whitespace. The validation runs before `npm install <package>` or `npx yarn add <package>` is executed.","commonSituations":"User-supplied or templated package names containing spaces or special characters; a misconfigured package reference pulled from a template file; an attempt to pass a version inline (e.g. \"pkg@1.0.0\") into the package slot.","solutions":["Pass only the package name without version (version goes in the separate version argument) and ensure it matches ^(@scope/)?name with allowed chars [A-Za-z0-9._-].","Strip whitespace and quotes from the source before calling EnsureSafePackageName.","If the value legitimately contains special characters, it is not a valid npm package name — correct the upstream data.","Treat this exception as a security stop: never bypass it by constructing the npm command manually."],"exampleFix":"// before\nhelper.NpmInstallPackage(\"my package;rm -rf /\", \"1.0.0\", dir);\n\n// after — name must match ^(@[a-zA-Z0-9][a-zA-Z0-9._-]*/)?[a-zA-Z0-9][a-zA-Z0-9._-]*$\nhelper.NpmInstallPackage(\"@scope/my-package\", \"1.0.0\", dir);","handlingStrategy":"validation","validationCode":"using System.Text.RegularExpressions;\nprivate static readonly Regex SafePkg = new(@\"^(@[a-zA-Z0-9][a-zA-Z0-9._-]*/)?[a-zA-Z0-9][a-zA-Z0-9._-]*$\", RegexOptions.Compiled);\nstatic string EnsurePkg(string name) =>\n    (string.IsNullOrWhiteSpace(name) || !SafePkg.IsMatch(name))\n        ? throw new ArgumentException(\"Invalid npm package name\") : name;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate package names with the same regex before calling NpmHelper.","Never pass user input unsanitized into package-name slots; reject anything with spaces or shell metacharacters.","Keep version separate from package name (do not inline pkg@version)."],"tags":["npm","command-injection","validation","abp-cli","security"],"backgroundTag":null,"analyzedSha":"7ed43b1931b9df46a50c0c59148a18645641d0df","analyzedAt":"2026-08-13T16:26:11.351Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}