{"record":{"id":"587801729520b3f5","repo":"xai-org/grok-build","slug":"what-value-contains-whitespace-or-control-ch","errorCode":null,"errorMessage":"{what} '{value}' contains whitespace or control characters","messagePattern":"(.+?) '(.+?)' contains whitespace or control characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-workspace/src/session/git.rs","lineNumber":3089,"sourceCode":"            .map(str::to_owned)\n            .collect();\n        return Ok(GitSyncBaseResult {\n            outcome: GitSyncBaseOutcome::Conflicts { files },\n        });\n    }\n    anyhow::bail!(\"merge of base ref '{base}' failed: {merge_out}\")\n}\n/// Reject a ref/branch value that could be parsed as a git option (leading `-`)\n/// or that carries whitespace/control characters or `..`. A boundary guard for\n/// client-influenced refs (notably `base_ref`) so they cannot be smuggled in as\n/// flags; combined with `--end-of-options` at each call site.\nfn ensure_ref_arg_safe(value: &str, what: &str) -> Result<()> {\n    anyhow::ensure!(!value.is_empty(), \"{what} must not be empty\");\n    anyhow::ensure!(\n        !value.starts_with('-'),\n        \"{what} '{value}' must not start with '-'\"\n    );\n    anyhow::ensure!(\n        !value.chars().any(|c| c.is_whitespace() || c.is_control()),\n        \"{what} '{value}' contains whitespace or control characters\"\n    );\n    anyhow::ensure!(\n        !value.contains(\"..\"),\n        \"{what} '{value}' must not contain '..'\"\n    );\n    Ok(())\n}\n/// Seed a committed `.gitignore` (secrets never enter git)\n/// when a fresh conversation branch is created and the repo has none. Distinct\n/// from [`seed_default_excludes`], which seeds the *local-only* `info/exclude`\n/// as a `stage_all` backstop; this file is meant to be committed, so it also\n/// protects explicit user commits and BYO-remote exports. Never overwrites an\n/// existing `.gitignore`.\nasync fn seed_default_gitignore(git_root: &Path) -> Result<()> {\n    let path = git_root.join(\".gitignore\");\n    if tokio::fs::metadata(&path).await.is_ok() {","sourceCodeStart":3071,"sourceCodeEnd":3107,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-workspace/src/session/git.rs#L3071-L3107","documentation":"ensure_ref_arg_safe rejects ref values containing whitespace or control characters because git refs cannot contain them, and embedded control characters (newlines, NULs, ANSI escapes) can corrupt CLI argument construction or log output. The library throws this to stop malformed client-influenced refs from reaching spawned git processes.","triggerScenarios":"Passing a ref containing a space, tab, newline, or any char where c.is_whitespace() || c.is_control() into a git operation validated by ensure_ref_arg_safe (crates/codegen/xai-grok-workspace/src/session/git.rs:3089), e.g. branch = \"feature x\" or a ref parsed out of a log line including a trailing '\\n'.","commonSituations":"A branch name with spaces created in another tool; a ref extracted from text output without trimming the trailing newline; copy-pasted branch names with non-breaking spaces; a payload with embedded '\\n' attempting log/command injection.","solutions":["Trim the ref and remove/replace whitespace (use '-' or '_' as separators) before calling the API.","Decode or re-parse the ref from a structured source (JSON field, not scraped text) so control characters are not carried over.","Reject the input at your own boundary using value.chars().all(|c| !c.is_whitespace() && !c.is_control())."],"exampleFix":"// before\nlet branch = format!(\"{}\\n\", stdout_line); // ref scraped from git output\n// after\nlet branch = stdout_line.trim().to_string();\nanyhow::ensure!(branch.chars().all(|c| !c.is_whitespace() && !c.is_control()), \"invalid ref\");","handlingStrategy":"validation","validationCode":"let clean = ref_name.trim();\nif clean.is_empty() || clean.chars().any(|c| c.is_whitespace() || c.is_control()) {\n    return Err(\"ref contains whitespace or control characters\".into());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always trim strings parsed from git output or logs before using them as refs.","Reject rather than silently strip whitespace — silent stripping can change meaning.","Ban control characters explicitly in your ref input validation."],"tags":["git","validation","input-sanitization"],"backgroundTag":"invalid-git-ref","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}