{"record":{"id":"94247e53a94e010f","repo":"MuntashirAkon/AppManager","slug":"error-invalid-characters-in-arguments-n","errorCode":null,"errorMessage":"Error! Invalid characters in arguments.\\n","messagePattern":"Error! Invalid characters in arguments\\.\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/main/cpp/run_server.c","lineNumber":92,"sourceCode":"        fprintf(stderr,\n                \"USAGE: %s <port> <token> <am_jar_name> <main_jar_name> <app_id> <user_id> <debug(1|0)> [extra_args...]\\n\",\n                argv[0]);\n        return 1;\n    }\n\n    const char *port = argv[1];\n    const char *token = argv[2];\n    const char *am_jar_name = argv[3];\n    const char *main_jar_name = argv[4];\n    const char *app_id = argv[5];\n    const char *user_id = argv[6];\n    const char *debug = argv[7];\n    const char *bgrun = \"1\";\n\n    // Validate Paths\n    if (!is_safe_string(am_jar_name) || !is_safe_string(main_jar_name) || !is_safe_string(app_id) ||\n        !is_safe_string(user_id)) {\n        fprintf(stderr, \"Error! Invalid characters in arguments.\\n\");\n        return 1;\n    }\n\n    // Validate debug and bgrun\n    if ((strcmp(debug, \"0\") != 0 && strcmp(debug, \"1\") != 0)) {\n        fprintf(stderr, \"Error! debug must be either 0 or 1.\\n\");\n        return 1;\n    }\n\n    // /data/local/tmp/am.jar\n    char exec_jar_path[512];\n    if (snprintf(exec_jar_path, sizeof(exec_jar_path), \"%s/%s\", TMP_PATH, am_jar_name) >=\n        sizeof(exec_jar_path)) {\n        fprintf(stderr, \"Error! Buffer overflow on exec_jar_path.\\n\");\n        return 1;\n    }\n\n    // /data/local/tmp/main.jar","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/cpp/run_server.c#L74-L110","documentation":"is_safe_string() rejected at least one of the path-bearing arguments (am_jar_name, main_jar_name, app_id, user_id) because it contains characters unsafe for use in shell exec paths or argument strings (e.g. spaces, quotes, semicolons, path separators or control characters). The binary aborts before doing any filesystem work to avoid command/path injection.","triggerScenarios":"Any of the four validated arguments fails is_safe_string(), e.g. app_id or user_id containing a space, a semicolon, quotes, newlines, or characters outside the allowed safe set.","commonSituations":"app_id built from untrusted remote data; user_id containing whitespace from a trim-less input; jar filenames pasted with spaces or shell metacharacters; locale/encoding introducing unexpected bytes.","solutions":["Sanitize each argument on the caller side before exec (strip/escape unsafe characters, validate against ^[A-Za-z0-9._-]+$)","Pass values via a config file or environment instead of shell argv if they can contain arbitrary characters","Log/reject the offending value in app code so users see which field was invalid"],"exampleFix":"// before\nString appId = userInput;\n// after\nif (!appId.matches(\"[A-Za-z0-9._-]+\")) throw new IllegalArgumentException(\"invalid app_id\");","handlingStrategy":"validation","validationCode":"private static boolean isSafe(String s) {\n    return s != null && s.matches(\"[A-Za-z0-9._-]+\") && s.length() <= 256;\n}\nif (!(isSafe(amJar) && isSafe(mainJar) && isSafe(appId) && isSafe(userId)))\n    throw new IllegalArgumentException(\"unsafe characters in run_server arguments\");","typeGuard":"function isSafeArg(v: unknown): v is string {\n  return typeof v === 'string' && /^[A-Za-z0-9._-]+$/.test(v) && v.length <= 256;\n}","tryCatchPattern":null,"preventionTips":["Whitelist-validate every dynamic value before exec","Never pass user-controlled or remote data unescaped into argv","Unit-test inputs containing spaces, quotes, and unicode"],"tags":["validation","security","native"],"backgroundTag":"invalid-argument-format","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}