{"record":{"id":"6455c993f0280dcc","repo":"docker/cli","slug":"invalid-user-w","errorCode":null,"errorMessage":"invalid user: %w","messagePattern":"invalid user: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/connhelper/ssh/ssh.go","lineNumber":112,"sourceCode":"\tif err != nil {\n\t\treturn nil\n\t}\n\tif remoteCommand != \"\" {\n\t\tsshArgs = append(sshArgs, remoteCommand)\n\t}\n\treturn sshArgs\n}\n\nfunc (sp *Spec) args(sshFlags ...string) ([]string, error) {\n\tvar args []string\n\tif sp.Host == \"\" {\n\t\treturn nil, errors.New(\"no host specified\")\n\t}\n\tif sp.User != \"\" {\n\t\t// Quote user, as it's obtained from the URL.\n\t\tusr, err := syntax.Quote(sp.User, syntax.LangPOSIX)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid user: %w\", err)\n\t\t}\n\t\targs = append(args, \"-l\", usr)\n\t}\n\tif sp.Port != \"\" {\n\t\t// Quote port, as it's obtained from the URL.\n\t\tport, err := syntax.Quote(sp.Port, syntax.LangPOSIX)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid port: %w\", err)\n\t\t}\n\t\targs = append(args, \"-p\", port)\n\t}\n\n\t// We consider \"sshFlags\" to be \"trusted\", and set from code only,\n\t// as they are not parsed from the DOCKER_HOST URL.\n\targs = append(args, sshFlags...)\n\n\thost, err := syntax.Quote(sp.Host, syntax.LangPOSIX)\n\tif err != nil {","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/connhelper/ssh/ssh.go#L94-L130","documentation":"Raised in Spec.args (ssh.go:110-112) when the user portion of the ssh URL cannot be POSIX-shell-quoted by syntax.Quote. The user string is parsed from the URL (URL-decoded) and must be re-quoted before being passed to ssh's `-l` flag; if it contains bytes the quoting library cannot handle, this wraps the error.","triggerScenarios":"Spec.args/Args/Command is called after a Spec was built from a URL whose User field contains characters that syntax.Quote rejects (e.g. a NUL byte or other control character that cannot appear in a POSIX-safe token).","commonSituations":"A DOCKER_HOST ssh URL with a username containing an embedded NUL or other non-printable control character, often from a misencoded environment variable or a copy-paste with hidden bytes. Extremely rare in normal use.","solutions":["Inspect the username in the DOCKER_HOST URL for hidden/control characters.","Re-enter the username as plain ASCII, avoiding control characters.","Percent-encode any legitimately special characters in the URL username."],"exampleFix":"# before — hidden control char in username (e.g. NUL)\nexport DOCKER_HOST='ssh://user<x00>@host'\n# after — clean ASCII username\nexport DOCKER_HOST='ssh://user@host'","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(daemonURL)\nif u != nil && u.User != nil {\n    if !isPrintableASCII(u.User.Username()) {\n        return errors.New(\"ssh URL username must be printable ASCII\")\n    }\n}","typeGuard":"func isPrintableASCII(s string) bool {\n    for _, r := range s {\n        if r < 0x20 || r > 0x7e {\n            return false\n        }\n    }\n    return true\n}","tryCatchPattern":"args, err := spec.Args(remote...)\nif err != nil {\n    return fmt.Errorf(\"cannot build ssh args (bad user?): %w\", err)\n}","preventionTips":["Restrict DOCKER_HOST usernames to printable ASCII.","Sanitize environment-sourced values before constructing URLs.","Percent-encode legitimate non-ASCII characters in the URL user segment."],"tags":["connhelper","ssh","url","user","quoting","shell-injection"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}