{"record":{"id":"60cc6b391cfd5dff","repo":"golang/go","slug":"invalid-flag-in-s-s-see-https-go-dev-s-inval","errorCode":null,"errorMessage":"invalid flag in %s: %s (see https://go.dev/s/invalidflag)","messagePattern":"invalid flag in (.+?): (.+?) \\(see https://go\\.dev/s/invalidflag\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/work/security.go","lineNumber":466,"sourceCode":"\t\t\t\t}\n\n\t\t\t\t// Permit -I= /path, -I $SYSROOT.\n\t\t\t\tif i+1 < len(list) && arg == \"-I\" {\n\t\t\t\t\tif (strings.HasPrefix(list[i+1], \"=\") || strings.HasPrefix(list[i+1], \"$SYSROOT\")) &&\n\t\t\t\t\t\tload.SafeArg(list[i+1][1:]) {\n\t\t\t\t\t\ti++\n\t\t\t\t\t\tcontinue Args\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif i+1 < len(list) {\n\t\t\t\t\treturn fmt.Errorf(\"invalid flag in %s: %s %s (see https://go.dev/s/invalidflag)\", source, arg, list[i+1])\n\t\t\t\t}\n\t\t\t\treturn fmt.Errorf(\"invalid flag in %s: %s without argument (see https://go.dev/s/invalidflag)\", source, arg)\n\t\t\t}\n\t\t}\n\tBad:\n\t\treturn fmt.Errorf(\"invalid flag in %s: %s (see https://go.dev/s/invalidflag)\", source, arg)\n\t}\n\treturn nil\n}\n","sourceCodeStart":448,"sourceCodeEnd":470,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/work/security.go#L448-L470","documentation":"Thrown by checkFlags at the `Bad:` label when a flag matches neither the allow list nor any valid-with-next-arg pattern (and is not rescued by CGO_*_ALLOW). It is the catch-all rejection for an unrecognized or disallowed cgo compiler/linker flag.","triggerScenarios":"A #cgo CFLAGS/LDFLAGS line or CGO_CFLAGS/LDFLAGS env var contains a token that does not match any validCompilerFlags/validLinkerFlags entry and is not on the allow list — e.g. `-framework`, `-Wl,-rpath`, an exotic `-fplugin`, or an unsafe construct.","commonSituations":"Adding macOS-specific `-framework Foo` to a portable package; passing `-Wl,--as-needed` which is not on the allow list; vendored C code with toolchain-specific tuning flags; porting flags from a Makefile verbatim.","solutions":["Remove the unrecognized flag from the #cgo line or env var.","Replace it with an allow-listed equivalent if one exists.","Add an RE2-valid CGO_CFLAGS_ALLOW regexp that whitelists the specific flag (use sparingly; it bypasses the security check).","Use `go build -x` to confirm the resolved flag set."],"exampleFix":"// before\n// #cgo LDFLAGS: -Wl,-rpath,/opt/lib\n\n// after\n// #cgo LDFLAGS: -L/opt/lib","handlingStrategy":"validation","validationCode":"// Flag tokens not on the allow list (illustrative subset)\nallowedPrefix := []string{\"-O\", \"-g\", \"-I\", \"-L\", \"-D\", \"-U\", \"-std=\", \"-Wall\", \"-Werror\"}\nflags := strings.Fields(os.Getenv(\"CGO_CFLAGS\"))\nfor _, f := range flags {\n    ok := false\n    for _, p := range allowedPrefix { if strings.HasPrefix(f, p) { ok = true; break } }\n    if !ok { log.Printf(\"warn: %s may be rejected by checkFlags\", f) }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer allow-listed gcc/ld flags in #cgo directives.","Use CGO_CFLAGS_ALLOW (valid RE2) only for genuine exceptions.","Run `go vet`/`go build -x` early to catch rejected flags."],"tags":["go-toolchain","cgo","flags","security","validation"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}