{"record":{"id":"624b4eb9cb088111","repo":"NationalSecurityAgency/ghidra","slug":"unknown-tag-el-getname","errorCode":null,"errorMessage":"Unknown tag: {el.getName()}","messagePattern":"Unknown tag: (.+?)","errorType":"exception","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/protocol/QueryNearest.java","lineNumber":140,"sourceCode":"\t\tsignifthresh = Double.parseDouble(parser.end().getText());\n\t\tparser.start(\"max\");\n\t\tmax = SpecXmlUtils.decodeInt(parser.end().getText());\n\t\twhile (parser.peek().isStart()) {\n\t\t\tXmlElement el = parser.peek();\n\t\t\tif (el.getName().equals(\"vectormax\")) {\n\t\t\t\tparser.start();\n\t\t\t\tvectormax = SpecXmlUtils.decodeInt(parser.end().getText());\n\t\t\t}\n\t\t\telse if (el.getName().equals(\"categories\")) {\n\t\t\t\tparser.start();\n\t\t\t\tfillinCategories = SpecXmlUtils.decodeBoolean(parser.end().getText());\n\t\t\t}\n\t\t\telse if (el.getName().equals(\"exefilter\")) {\n\t\t\t\tbsimFilter = new BSimFilter();\n\t\t\t\tbsimFilter.restoreXml(parser);\n\t\t\t}\n\t\t\telse\n\t\t\t\tthrow new LSHException(\"Unknown tag: \"+el.getName());\n\t\t\t\t\n\t\t}\n\t\tparser.end();\n\t}\n\n}\n","sourceCodeStart":122,"sourceCodeEnd":147,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/protocol/QueryNearest.java#L122-L147","documentation":"Thrown by QueryNearest.restoreXml while deserializing a <querynearest> BSim request. After parsing manage, simthresh, signifthresh and max, the parser loops over remaining start elements and only accepts <vectormax>, <categories>, and <exefilter>; any other tag name raises LSHException. This is strict schema validation so that malformed or version-mismatched XML fails fast instead of being silently dropped.","triggerScenarios":"Calling QueryNearest.restoreXml(parser, vectorFactory) on XML that contains an element other than vectormax/categories/exefilter after <max>. Happens when the client and server disagree on the request schema (e.g. newer client serializes a tag the older parser doesn't know), or when hand-edited/corrupt XML is fed in.","commonSituations":"Version skew between a BSim client and server (a field added in a newer Ghidra release). Feeding a query XML document produced by a different BSim dialect. Manually constructing XML and misspelling a tag.","solutions":["Ensure the client and server run the same Ghidra/BSim version so the serialized XML schema matches the parser.","Validate the XML against the expected tag set (vectormax, categories, exefilter) before calling restoreXml.","Inspect the offending tag name in the exception message to identify which extra field was serialized and remove or downgrade it.","If intercepting traffic, regenerate the request with a QueryNearest object via saveXml instead of hand-authoring XML."],"exampleFix":"// before\nQueryNearest q = new QueryNearest();\nq.restoreXml(parser, vectorFactory); // throws on unknown tag\n\n// after\nSet<String> allowed = Set.of(\"vectormax\", \"categories\", \"exefilter\", \"simthresh\", \"signifthresh\", \"max\");\n// pre-scan: ensure remaining child tags are within the allowed set\nQueryNearest q = new QueryNearest();\ntry {\n    q.restoreXml(parser, vectorFactory);\n} catch (LSHException e) {\n    throw new LSHException(\"Schema mismatch - check BSim client/server version: \" + e.getMessage());\n}","handlingStrategy":"validation","validationCode":"Set<String> allowed = Set.of(\"vectormax\", \"categories\", \"exefilter\");\n// pre-walk child starts of the querynearest element and assert names are in `allowed`\n// before calling restoreXml","typeGuard":"static boolean isKnownQueryNearestChild(String tag) {\n    return Set.of(\"vectormax\", \"categories\", \"exefilter\").contains(tag);\n}","tryCatchPattern":"try {\n    q.restoreXml(parser, vectorFactory);\n} catch (LSHException e) {\n    if (e.getMessage().startsWith(\"Unknown tag:\")) {\n        throw new LSHException(\n            \"BSim schema mismatch (client/server version?): \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Keep BSim client and server on the same Ghidra release.","Prefer building requests via the QueryNearest object API and saveXml over hand-authoring XML.","Version-stamp your serialized requests so a mismatch can be detected before parsing."],"tags":["bsim","xml","deserialization","schema-version"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}