{"record":{"id":"a6a59fc7a7b2bacc","repo":"jdx/mise","slug":"invalid-remote-kind-value","errorCode":null,"errorMessage":"invalid remote {kind}: {value}","messagePattern":"invalid remote (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/remote.rs","lineNumber":2172,"sourceCode":"            base.join(path)\n        };\n        absolutize(&path)\n    })\n    .transpose()\n}\n\nfn absolutize(path: &Path) -> Result<PathBuf> {\n    if path.is_absolute() {\n        Ok(path.to_path_buf())\n    } else {\n        Ok(std::env::current_dir()?.join(path))\n    }\n}\n\nfn validate_ssh_atom(kind: &str, value: &str) -> Result<()> {\n    validate_value(kind, value)?;\n    if value.starts_with('-') || value.chars().any(char::is_whitespace) {\n        bail!(\"invalid remote {kind}: {value}\");\n    }\n    Ok(())\n}\n\nfn validate_value(kind: &str, value: &str) -> Result<()> {\n    if value.is_empty() || value.contains('\\0') {\n        bail!(\"remote {kind} cannot be empty or contain NUL\");\n    }\n    Ok(())\n}\n\nfn validate_staging_path(path: &str) -> Result<()> {\n    if !path.starts_with(\"/tmp/mise-bootstrap.\")\n        || path[\"/tmp/mise-bootstrap.\".len()..].is_empty()\n        || path.chars().any(char::is_whitespace)\n    {\n        bail!(\"remote mktemp returned an unsafe staging path: {path:?}\");\n    }","sourceCodeStart":2154,"sourceCodeEnd":2190,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/remote.rs#L2154-L2190","documentation":"`validate_ssh_atom` validates individual remote command components (host, user, remote paths, args — the `kind` names which) and rejects values that start with '-' (which SSH would parse as a flag) or contain whitespace (which would split an argument). This is an injection/argument-confusion guard before values are passed to the ssh command line.","triggerScenarios":"Configuring a remote target with a host, user, or path that begins with '-' or contains spaces — e.g. host name with a space, a path with unquoted spaces, or a malicious-looking '-oProxyCommand=...' value.","commonSituations":"Typo in remote config where the value absorbed a separator (e.g. `host -p 2222` pasted as one string); paths containing spaces on the remote; attempted option injection into ssh.","solutions":["Remove leading dashes and whitespace from the configured host/user/path value","Quote or escape spaces in filesystem paths at the source of configuration, or use the path as a single atom without spaces","If ssh needs extra flags (e.g. port), use the dedicated option field/args rather than embedding them in the host atom"],"exampleFix":"// before\nMISE_REMOTE_HOST=\"deploy@host -p 2222\"   # starts atom with flag injection\n// after\nMISE_REMOTE_HOST=\"deploy@host\"\nMISE_REMOTE_PORT=2222   # pass options as their own fields","handlingStrategy":"validation","validationCode":"fn is_safe_ssh_atom(v: &str) -> bool {\n    !v.is_empty() && !v.starts_with('-') && !v.chars().any(char::is_whitespace) && !v.contains('\\\\0')\n}\n// before invoking:\nassert!(is_safe_ssh_atom(host), \"host must not start with '-' or contain spaces\");","typeGuard":"fn valid_remote_host(v: &str) -> Option<&str> {\n    (!v.starts_with('-') && !v.contains(char::is_whitespace)).then_some(v)\n}","tryCatchPattern":"match Err(e) if e.to_string().starts_with(\"invalid remote \") {\n    // fix the offending config value named in `kind` and retry\n    fix_remote_config(&kind); retry();\n}","preventionTips":["Never embed ssh flags (ports, options) inside host/user values","Quote paths with spaces at config time or avoid spaces entirely","Keep one value per config field; no shell-style bundling"],"tags":["remote","ssh","validation","injection"],"backgroundTag":"invalid-argument-value","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}