{"record":{"id":"9ec8db341a020c50","repo":"golang/go","slug":"leading-hyphen","errorCode":null,"errorMessage":"leading hyphen","messagePattern":"leading hyphen","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/vcs/vcs.go","lineNumber":1095,"sourceCode":"\t\tSubDir:   mmi.SubDir,\n\t\tIsCustom: true,\n\t\tVCS:      vcs,\n\t}\n\treturn rr, nil\n}\n\n// validateRepoSubDir returns an error if subdir is not a valid subdirectory path.\n// We consider a subdirectory path to be valid as long as it doesn't have a leading\n// slash (/) or hyphen (-).\nfunc validateRepoSubDir(subdir string) error {\n\tif subdir == \"\" {\n\t\treturn nil\n\t}\n\tif subdir[0] == '/' {\n\t\treturn errors.New(\"leading slash\")\n\t}\n\tif subdir[0] == '-' {\n\t\treturn errors.New(\"leading hyphen\")\n\t}\n\treturn nil\n}\n\n// validateRepoRoot returns an error if repoRoot does not seem to be\n// a valid URL with scheme.\nfunc validateRepoRoot(repoRoot string) error {\n\turl, err := urlpkg.Parse(repoRoot)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif url.Scheme == \"\" {\n\t\treturn errors.New(\"no scheme\")\n\t}\n\tif url.Scheme == \"file\" {\n\t\treturn errors.New(\"file scheme disallowed\")\n\t}\n\treturn nil","sourceCodeStart":1077,"sourceCodeEnd":1113,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/vcs/vcs.go#L1077-L1113","documentation":"validateRepoSubDir rejects subdirs beginning with `-`. This is a security guard: a leading hyphen could be interpreted as a command-line flag by the underlying VCS tool, enabling flag-injection.","triggerScenarios":"A meta tag or import path supplies a subdir starting with `-`, e.g. `-something`.","commonSituations":"Malicious or malformed vanity meta tags crafted to inject flags.","solutions":["Fix the subdir so it does not start with a hyphen.","Audit the vanity server / meta tags if untrusted."],"exampleFix":"<!-- before -->\n<meta name=\"go-import\" content=\"example.com -flag git+ssh://...\">\n<!-- after -->\n<meta name=\"go-import\" content=\"example.com pkg git+ssh://...\">","handlingStrategy":"validation","validationCode":"// Reject subdirs that could inject flags.\nfunc safeSubdir(s string) error {\n    if strings.HasPrefix(s, \"-\") { return errors.New(\"subdir must not start with a hyphen\") }\n    return nil\n}","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Sanitize any untrusted subdir before passing to VCS tooling.","Treat leading-hyphen subdirs as suspicious (potential flag injection)."],"tags":["vcs","validation","security","flag-injection"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}