{"record":{"id":"654371ea8987e928","repo":"NationalSecurityAgency/ghidra","slug":"bad-characters-in-proposed-category-type","errorCode":null,"errorMessage":"Bad characters in proposed category type","messagePattern":"Bad characters in proposed category type","errorType":"validation","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java","lineNumber":2185,"sourceCode":"\t\t\t\tthrow new LSHException(\"Bad characters in one or more proposed \" + type);\n\t\t\t}\n\t\t\tif (!names.add(name)) {\n\t\t\t\tthrow new LSHException(\"Duplicate \" + type + \" entry specified: \" + name);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Entry point for the InstallCategoryRequest command\n\t * @param query the query to execute\n\t * @throws LSHException if the category is invalid or already exists\n\t * @throws SQLException if there is an error issuing the query\n\t */\n\tprivate void fdbInstallCategory(InstallCategoryRequest query)\n\t\t\tthrows LSHException, SQLException {\n\t\tResponseInfo response = query.installresponse;\n\t\tif (!CategoryRecord.enforceTypeCharacters(query.type_name)) {\n\t\t\tthrow new LSHException(\"Bad characters in proposed category type\");\n\t\t}\n\t\tif (query.isdatecolumn) {\n\t\t\tinfo.dateColumnName = query.type_name;\n\t\t\tkeyValueTable.insert(\"datecolumn\", info.dateColumnName);\n\t\t\tresponse.info = info;\n\t\t\treturn;\n\t\t}\n\t\t// Check for existing category\n\t\tif (info.execats != null) {\n\t\t\tfor (String cat : info.execats) {\n\t\t\t\tif (cat.equals(query.type_name)) {\n\t\t\t\t\tthrow new LSHException(\"Executable category already exists\");\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif (info.execats == null) {\n\t\t\tinfo.execats = new ArrayList<>();\n\t\t}","sourceCodeStart":2167,"sourceCodeEnd":2203,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java#L2167-L2203","documentation":"Thrown by fdbInstallCategory when query.type_name fails CategoryRecord.enforceTypeCharacters (only alnum, space, '.', '_', ':', '/', '(', ')' allowed). The category type name is used as a SQL column identifier and stored in XML, so invalid characters are rejected before any write occurs.","triggerScenarios":"Submitting an InstallCategoryRequest whose type_name is null, empty, or contains characters outside the allowed set (hyphens, quotes, semicolons, etc.).","commonSituations":"Programmatic category creation from external metadata containing punctuation; user-typed category names without validation; importing schema labels with reserved SQL characters.","solutions":["Validate query.type_name with CategoryRecord.enforceTypeCharacters before issuing the InstallCategoryRequest.","Normalize the name: strip or replace disallowed characters (e.g., '-' to '_').","Reject null/empty type_name early in the calling code."],"exampleFix":"// before\nreq.type_name = \"compiler-version\"; // hyphen rejected\n// after\nif (!CategoryRecord.enforceTypeCharacters(req.type_name)) {\n    req.type_name = req.type_name.replace('-', '_'); // \"compiler_version\"\n}","handlingStrategy":"validation","validationCode":"if (!CategoryRecord.enforceTypeCharacters(req.type_name)) {\n    throw new IllegalArgumentException(\"Invalid category name: \" + req.type_name);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate category names with enforceTypeCharacters at the UI boundary.","Keep a reference of allowed characters visible to users entering names."],"tags":["bsim","validation","input-sanitization"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}