{"record":{"id":"9106e77d78272f22","repo":"siyuan-note/siyuan","slug":"path-contains-invalid-character-s","errorCode":null,"errorMessage":"path contains invalid character [%s]","messagePattern":"path contains invalid character \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/elevator_windows.go","lineNumber":136,"sourceCode":"\tutil.PushMsg(Conf.language(252), 0)\n}\n\nfunc isUsingMicrosoftDefender() bool {\n\tif !gulu.OS.IsWindows() {\n\t\treturn false\n\t}\n\n\tcmd := exec.Command(\"powershell\", \"-Command\", \"Get-MpPreference\")\n\tgulu.CmdAttr(cmd)\n\treturn cmd.Run() == nil\n}\n\n// validateExclusionPath 校验用于添加到 Windows Defender 排除项的路径，\n// 拒绝包含 cmd.exe 或 PowerShell 元字符的路径，防止通过未转义的路径字符串实现命令注入\nfunc validateExclusionPath(path string) error {\n\tfor _, c := range path {\n\t\tif strings.ContainsRune(\"&|<>^%!\\\"'$`\", c) {\n\t\t\treturn fmt.Errorf(\"path contains invalid character [%s]\", string(c))\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc getElevatorBin() string {\n\televator := filepath.Join(util.WorkingDir, \"kernel\", \"elevator.exe\")\n\tif \"dev\" == util.Mode || !gulu.File.IsExist(elevator) {\n\t\televator = filepath.Join(util.WorkingDir, \"elevator\", \"elevator-\"+runtime.GOARCH+\".exe\")\n\t}\n\treturn elevator\n}\n","sourceCodeStart":118,"sourceCodeEnd":149,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/elevator_windows.go#L118-L149","documentation":"Returned by validateExclusionPath when the install path or workspace directory contains a character from the set & | < > ^ % ! \" ' $ ` — these are cmd.exe and PowerShell metacharacters. The guard prevents command injection through the user-controlled workspace path when it's passed (via ShellExecute 'runas') to the elevated elevator process that runs Defender exclusion commands.","triggerScenarios":"AddMicrosoftDefenderExclusion calls validateExclusionPath on both the install path and util.WorkspaceDir. If the user chose a workspace directory containing any metacharacter (e.g., a path with an ampersand or dollar sign), validation fails and Defender exclusion is skipped.","commonSituations":"User set the SiYuan workspace to a path like C:\\Users\\Me & You\\Notes or D:\\Data$\\SiYuan. Less commonly, the install path itself contains a special character (e.g., installed under C:\\Program Files (x86)\\... — parentheses are fine, but & or % in a custom install path would trigger it).","solutions":["Move the SiYuan workspace to a directory whose path contains no shell metacharacters (& | < > ^ % ! \" ' $ `).","If the install path itself is the problem, reinstall SiYuan to a path without special characters.","If you cannot move the workspace, you can manually add the exclusion in Windows Defender settings (Settings > Update & Security > Windows Security > Virus & threat protection > Exclusions)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-validate workspace path before kernel boot\nfunc hasShellMetachar(p string) bool {\n    return strings.ContainsAny(p, \"&|<>^%!\\\"'$`\")\n}\nif hasShellMetachar(util.WorkspaceDir) {\n    return errors.New(\"workspace path must not contain shell metacharacters\")\n}","typeGuard":null,"tryCatchPattern":"if err := model.AddMicrosoftDefenderExclusion(); err != nil {\n    if strings.Contains(err.Error(), \"invalid character\") {\n        // path has metacharacters — move workspace or add exclusion manually\n        logging.LogWarnf(\"workspace path rejected by Defender exclusion guard: %v\", err)\n    }\n}","preventionTips":["Choose a workspace path without & | < > ^ % ! \\\" ' $ ` characters.","Avoid installing SiYuan under a path with special characters.","If the path can't be changed, add the exclusion manually in Windows Defender settings."],"tags":["windows","defender","security","command-injection","path-validation","platform-specific"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}