{"record":{"id":"8d92fb67c0bfbe50","repo":"jstedfast/MailKit","slug":"one-or-more-characters-in-the-string-are-prohibited","errorCode":null,"errorMessage":"One or more characters in the string are prohibited.","messagePattern":"One or more characters in the string are prohibited\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/SaslMechanism.cs","lineNumber":744,"sourceCode":"\t\t\tif (s == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (s));\n\n\t\t\tif (s.Length == 0)\n\t\t\t\treturn s;\n\n\t\t\tvar builder = new StringBuilder (s.Length);\n\t\t\tfor (int i = 0; i < s.Length; i++) {\n\t\t\t\tif (IsNonAsciiSpace (s[i])) {\n\t\t\t\t\t// non-ASCII space characters [StringPrep, C.1.2] that can be\n\t\t\t\t\t// mapped to SPACE (U+0020).\n\t\t\t\t\tbuilder.Append (' ');\n\t\t\t\t} else if (IsCommonlyMappedToNothing (s[i])) {\n\t\t\t\t\t// the \"commonly mapped to nothing\" characters [StringPrep, B.1]\n\t\t\t\t\t// that can be mapped to nothing.\n\t\t\t\t} else if (char.IsControl (s[i])) {\n\t\t\t\t\tthrow new ArgumentException (\"Control characters are prohibited.\", nameof (s));\n\t\t\t\t} else if (IsProhibited (s, i)) {\n\t\t\t\t\tthrow new ArgumentException (\"One or more characters in the string are prohibited.\", nameof (s));\n\t\t\t\t} else {\n\t\t\t\t\tbuilder.Append (s[i]);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn builder.ToString ().Normalize (NormalizationForm.FormKC);\n\t\t}\n\n\t\tinternal static string GenerateEntropy (int n)\n\t\t{\n\t\t\tvar entropy = new byte[n];\n\n\t\t\tusing (var rng = RandomNumberGenerator.Create ())\n\t\t\t\trng.GetBytes (entropy);\n\n\t\t\treturn Convert.ToBase64String (entropy);\n\t\t}\n\t}","sourceCodeStart":726,"sourceCodeEnd":762,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/SaslMechanism.cs#L726-L762","documentation":"During SASLprep (RFC 4013) normalization, SaslMechanism checks each character against the StringPrep prohibited tables (e.g. non-ASCII space, prohibited output, surrogates, tags). If any character is prohibited, it throws ArgumentException because the string cannot be used as a SASL identity.","triggerScenarios":"Passing a username/authorization id containing prohibited characters such as non-ASCII spaces (U+00A0), surrogates, or other StringPrep-table characters to a SaslMechanism constructor or credential property.","commonSituations":"Usernames copied from word processors containing non-breaking spaces, IDs containing emoji/surrogate pairs, credentials pasted from PDFs with exotic whitespace.","solutions":["Sanitize the input: replace prohibited/non-standard whitespace with a regular space or remove it before constructing the mechanism.","Normalize the string with s.Normalize(NormalizationForm.FormKC) and re-validate before passing it in.","Catch ArgumentException and prompt the user to correct the offending credential value."],"exampleFix":"// before\nvar mech = new SaslMechanismPlain(userName); // userName has U+00A0\n// after\nvar clean = userName.Normalize(NormalizationForm.FormKC).Replace('\\u00A0', ' ');\nvar mech = new SaslMechanismPlain(clean);","handlingStrategy":"validation","validationCode":"static string SanitizeSaslString(string s) {\n    var clean = new string(s.Where(c => !char.IsControl(c)).ToArray());\n    clean = clean.Normalize(NormalizationForm.FormKC).Replace('\\u00A0', ' ');\n    return clean;\n}\nvar mech = new SaslMechanismPlain(SanitizeSaslString(userName));","typeGuard":null,"tryCatchPattern":"try {\n    var mech = new SaslMechanismPlain(userName);\n} catch (ArgumentException) {\n    // username contains StringPrep-prohibited characters\n}","preventionTips":["Replace exotic whitespace (U+00A0, U+2007, etc.) with plain spaces before authenticating","Avoid usernames sourced from rich-text documents (PDFs, word processors)","Run Normalize(NormalizationForm.FormKC) on credentials as a pre-pass"],"tags":["sasl","argument-validation","stringprep"],"backgroundTag":"invalid-argument-value","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}