{"record":{"id":"602835d95d91d171","repo":"CherryHQ/cherry-studio","slug":"invalid-mcp-package-upload-file-name-contains-uns","errorCode":null,"errorMessage":"Invalid MCP package upload: file name contains unsupported characters","messagePattern":"Invalid MCP package upload: file name contains unsupported characters","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ai/mcp/McpPackageService.ts","lineNumber":297,"sourceCode":"  fileName: string,\n  packageFormat: McpPackageFormat\n): Buffer {\n  if (typeof fileName !== 'string') {\n    throw new Error('Invalid MCP package upload: file name must be a string')\n  }\n\n  const trimmedFileName = fileName.trim()\n  if (!trimmedFileName) {\n    throw new Error('Invalid MCP package upload: file name cannot be empty')\n  }\n  if (trimmedFileName !== fileName) {\n    throw new Error('Invalid MCP package upload: file name cannot contain leading or trailing whitespace')\n  }\n  if (trimmedFileName.includes('\\0') || /[/\\\\]/.test(trimmedFileName)) {\n    throw new Error('Invalid MCP package upload: file name cannot contain path separators')\n  }\n  if (!/^[A-Za-z0-9._ ()@+-]+$/.test(trimmedFileName)) {\n    throw new Error('Invalid MCP package upload: file name contains unsupported characters')\n  }\n  if (path.extname(trimmedFileName).toLowerCase() !== `.${packageFormat}`) {\n    throw new Error(`Invalid MCP package upload: expected a .${packageFormat} file`)\n  }\n\n  let buffer: Buffer\n  if (fileBuffer instanceof ArrayBuffer) {\n    buffer = Buffer.from(fileBuffer)\n  } else if (ArrayBuffer.isView(fileBuffer)) {\n    buffer = Buffer.from(fileBuffer.buffer, fileBuffer.byteOffset, fileBuffer.byteLength)\n  } else {\n    throw new Error('Invalid MCP package upload: file buffer must be an ArrayBuffer')\n  }\n\n  if (buffer.byteLength === 0) {\n    throw new Error('Invalid MCP package upload: file buffer cannot be empty')\n  }\n  if (buffer.byteLength > MCP_PACKAGE_UPLOAD_MAX_BYTES) {","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/CherryHQ/cherry-studio/blob/726446b54cd69ffe51a276638672f6d95ca0768c/src/main/ai/mcp/McpPackageService.ts#L279-L315","documentation":"Thrown by validatePackageUploadPayload when the trimmed filename contains characters outside the allow-list ^[A-Za-z0-9._ ()@+-]+$. The allow-list is deliberately strict because the filename flows into a temp-file path and, ultimately, into directory naming. Non-ASCII, quotes, shell metacharacters, and other punctuation are rejected.","triggerScenarios":"Renderer sent a filename with characters like &, ;, |, \", ', commas, non-Latin Unicode (e.g. CJK characters), emoji, or brackets other than the allowed (). For example \"my pkg (final).mcpb\" is allowed, but \"my pkg & final.mcpb\" is not.","commonSituations":"A package file was renamed by the user to include punctuation (commas, ampersands, quotes); a non-English locale filename; a CI-generated name with timestamps using colons (invalid on Windows and rejected here too).","solutions":["Rename the file on disk to use only the allowed characters [A-Za-z0-9._ ()@+-] before selecting it for upload.","If the renderer controls the name, sanitize it (replace disallowed chars with _ or -) before sending, but prefer renaming the source file so the user sees a consistent name.","For non-ASCII names, transliterate or strip diacritics before upload."],"exampleFix":"// before\nfile name: \"my pkg & tool.mcpb\"\n// after (rename on disk)\nfile name: \"my pkg and tool.mcpb\"","handlingStrategy":"validation","validationCode":"const ALLOWED = /^[A-Za-z0-9._ ()@+-]+$/\nfunction isAllowedFileName(fileName: string): boolean {\n  return ALLOWED.test(fileName)\n}","typeGuard":"function isAllowListedFileName(s: unknown): s is string {\n  return typeof s === 'string' && /^[A-Za-z0-9._ ()@+-]+$/.test(s)\n}","tryCatchPattern":null,"preventionTips":["Document the allowed character set in the package-author guide so authors name files accordingly.","In the renderer UI, show the allowed set and validate file.name before enabling upload.","For non-ASCII or punctuation-heavy names, rename the source file rather than trying to sanitize at upload time."],"tags":["mcp","upload","validation","ipc","filename"],"backgroundTag":null,"analyzedSha":"726446b54cd69ffe51a276638672f6d95ca0768c","analyzedAt":"2026-08-12T17:30:37.448Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}