{"record":{"id":"ac3615c337aae931","repo":"Tencent/WeKnora","slug":"invalid-environment-variables-w","errorCode":null,"errorMessage":"invalid environment variables: %w","messagePattern":"invalid environment variables: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":643,"sourceCode":"\treturn nil\n}\n\n// ValidateStdioConfig performs comprehensive validation of stdio configuration\n// This should be called before creating or executing any stdio-based MCP client\nfunc ValidateStdioConfig(command string, args []string, envVars map[string]string) error {\n\t// Validate command\n\tif err := ValidateStdioCommand(command); err != nil {\n\t\treturn fmt.Errorf(\"invalid command: %w\", err)\n\t}\n\n\t// Validate arguments\n\tif err := ValidateStdioArgs(args); err != nil {\n\t\treturn fmt.Errorf(\"invalid arguments: %w\", err)\n\t}\n\n\t// Validate environment variables\n\tif err := ValidateStdioEnvVars(envVars); err != nil {\n\t\treturn fmt.Errorf(\"invalid environment variables: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// SSRFSafeHTTPClientConfig contains configuration for the SSRF-safe HTTP client\ntype SSRFSafeHTTPClientConfig struct {\n\tTimeout            time.Duration\n\tMaxRedirects       int\n\tDisableKeepAlives  bool\n\tDisableCompression bool\n}\n\n// DefaultSSRFSafeHTTPClientConfig returns the default configuration\nfunc DefaultSSRFSafeHTTPClientConfig() SSRFSafeHTTPClientConfig {\n\treturn SSRFSafeHTTPClientConfig{\n\t\tTimeout:            30 * time.Second,\n\t\tMaxRedirects:       10,","sourceCodeStart":625,"sourceCodeEnd":661,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L625-L661","documentation":"ValidateStdioConfig wraps any error from ValidateStdioEnvVars with 'invalid environment variables: %w'. The inner error explains the specific violation: value exceeds 4096 chars, null bytes in value, or a dangerous shell pattern in the value. This is the aggregate entry point for env-var validation failures.","triggerScenarios":"Calling ValidateStdioConfig with an envVars map where any key/value fails ValidateStdioEnvVars (oversized value >4096, null bytes, or DangerousArgPatterns match).","commonSituations":"Very large secrets or tokens pasted into env config, values with special characters from shell snippets, or malformed generated configuration.","solutions":["Inspect the wrapped error to see which env var and which rule failed.","Shorten values exceeding 4096 characters (pass large data via file, not env).","Strip null bytes and shell metacharacters from values.","Validate env values at config ingestion time."],"exampleFix":"// before\nenvVars[\"BULK\"] = strings.Repeat(\"x\", 8192)\nerr := secutils.ValidateStdioConfig(cmd, args, envVars)\n// after\nenvVars[\"BULK\"] = strings.Repeat(\"x\", 4000)\nerr := secutils.ValidateStdioConfig(cmd, args, envVars)","handlingStrategy":"validation","validationCode":"for k, v := range envVars {\n    if len(v) > 4096 { return fmt.Errorf(\"env %q too long\", k) }\n    if strings.Contains(v, \"\\x00\") { return fmt.Errorf(\"env %q has null bytes\", k) }\n}","typeGuard":"func isSafeEnvVar(k, v string) bool {\n    return k != \"\" && len(v) <= 4096 && !strings.Contains(v, \"\\x00\")\n}","tryCatchPattern":"if err := secutils.ValidateStdioConfig(cmd, args, env); err != nil {\n    if strings.Contains(err.Error(), \"invalid environment variables\") {\n        return fmt.Errorf(\"fix env config: %w\", err)\n    }\n}","preventionTips":["Keep env values under 4096 chars; move bulk data to files.","Strip null bytes and shell metacharacters at ingestion.","Validate env maps when configuration is first loaded, not at spawn time."],"tags":["security","validation","stdio","environment-variables"],"backgroundTag":"invalid-env-var","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}