{"record":{"id":"71ed4d6166cd13ca","repo":"NationalSecurityAgency/ghidra","slug":"bad-character-in-h2-database-path-disallowed-char","errorCode":null,"errorMessage":"Bad character in H2 database path. Disallowed characters: ","messagePattern":"Bad character in H2 database path\\. Disallowed characters: ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimServerInfo.java","lineNumber":251,"sourceCode":"\t\t\treturn null;\n\t\t}\n\t\tuserinfo = userinfo.trim();\n\t\tint pwdSep = userinfo.indexOf(':');\n\t\tif (pwdSep == 0) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid userinfo specified\");\n\t\t}\n\t\telse if (pwdSep > 0 && (userinfo.length() - pwdSep) == 0) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid userinfo specified\");\n\t\t}\n\t\treturn userinfo;\n\t}\n\n\tprivate static String cleanupFilename(String name) {\n\t\t// transform dbName into acceptable H2 DB file path\n\n\t\tMatcher m = BAD_H2_CHARS_PATTERN.matcher(name);\n\t\tif (m.matches()) {\n\t\t\tthrow new IllegalArgumentException(\"Bad character in H2 database path. \" +\n\t\t\t\t\"Disallowed characters: \" + BAD_H2_CHARS);\n\t\t}\n\t\tString dbName = name.trim();\n\t\tdbName = dbName.replace(\"\\\\\", \"/\");\n\t\tif ((!dbName.startsWith(\"/\") && !isWindowsFilePath(dbName)) || dbName.endsWith(\"/\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid absolute file path: \" + dbName);\n\t\t}\n\t\tif (!dbName.endsWith(H2_FILE_EXTENSION)) {\n\t\t\tdbName += H2_FILE_EXTENSION;\n\t\t}\n\t\treturn dbName;\n\t}\n\n\tprivate static String checkURLField(String val, String name) {\n\t\tif (StringUtils.isEmpty(val)) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid \" + name + \" in URL\");\n\t\t}\n\t\treturn val.trim();","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimServerInfo.java#L233-L269","documentation":"Thrown by cleanupFilename() when a file-type database name contains one of the disallowed H2 characters defined in BAD_H2_CHARS (semicolon ';', single quote, double quote \"). These characters are blocked because H2 interprets them in connection/file paths and could cause injection or path errors. Throws IllegalArgumentException.","triggerScenarios":"Constructing a file-type BSimServerInfo with a path containing ';', \"', or '\"', e.g. 'new BSimServerInfo(\"/data/my;evil.mv.db\")'.","commonSituations":"User-supplied or templated paths that include quotes or semicolons; paths copied from configuration that contains shell-special characters.","solutions":["Remove or escape the disallowed characters (';', single quote, double quote) from the file path.","Validate the path against the BAD_H2_CHARS set before constructing BSimServerInfo.","Rename the target H2 file to avoid the forbidden characters."],"exampleFix":"// before\nnew BSimServerInfo(\"/data/bsim;drop.mv.db\");\n// after (no disallowed chars)\nnew BSimServerInfo(\"/data/bsimdrop.mv.db\");","handlingStrategy":"validation","validationCode":"if (dbName.matches(\".*[;'\\\"].*\")) {\n    throw new IllegalArgumentException(\"H2 path contains disallowed chars (;, ', \\\"): \" + dbName);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reject ';', single quote, and double quote in file database paths before constructing.","Sanitize user-supplied paths to strip BAD_H2_CHARS.","Prefer programmatic path construction over concatenating untrusted strings."],"tags":["bsim","validation","h2","security","database-url"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}