{"record":{"id":"ad7196f9fa1299c2","repo":"golang/go","slug":"s-invalid-subdirectory-q-v","errorCode":null,"errorMessage":"%s: invalid subdirectory %q: %v","messagePattern":"(.+?): invalid subdirectory %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/vcs/vcs.go","lineNumber":1050,"sourceCode":"\t// non-evil student). Instead, first verify the root and see\n\t// if it matches Bob's claim.\n\tif mmi.Prefix != importPath {\n\t\tif cfg.BuildV {\n\t\t\tlog.Printf(\"get %q: verifying non-authoritative meta tag\", importPath)\n\t\t}\n\t\tvar imports []metaImport\n\t\turl, imports, err = metaImportsForPrefix(mmi.Prefix, mod, security)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tmetaImport2, err := matchGoImport(imports, importPath)\n\t\tif err != nil || mmi != metaImport2 {\n\t\t\treturn nil, fmt.Errorf(\"%s and %s disagree about go-import for %s\", resp.URL, url, mmi.Prefix)\n\t\t}\n\t}\n\n\tif err := validateRepoSubDir(mmi.SubDir); err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: invalid subdirectory %q: %v\", resp.URL, mmi.SubDir, err)\n\t}\n\n\tif err := validateRepoRoot(mmi.RepoRoot); err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: invalid repo root %q: %v\", resp.URL, mmi.RepoRoot, err)\n\t}\n\tvar vcs *Cmd\n\tif mmi.VCS == \"mod\" {\n\t\tvcs = vcsMod\n\t} else {\n\t\tvcs = vcsByCmd(mmi.VCS)\n\t\tif vcs == nil {\n\t\t\treturn nil, fmt.Errorf(\"%s: unknown vcs %q\", resp.URL, mmi.VCS)\n\t\t}\n\t}\n\n\tif err := checkGOVCS(vcs, mmi.Prefix); err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":1032,"sourceCodeEnd":1068,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/vcs/vcs.go#L1032-L1068","documentation":"validateRepoSubDir rejected the SubDir field of the matched meta import. The validator disallows a leading '/' (\"leading slash\") or a leading '-' (\"leading hyphen\") to prevent argument injection into VCS commands. The %s is resp.URL, %q is the offending subdirectory, %v is the validator's message.","triggerScenarios":"A go-import meta tag's third field starts with '/' or '-', e.g. content=\"example.com git https://x /sub\".","commonSituations":"Vanity server misconfiguration writing an absolute path or a flag-like value into the subdirectory field.","solutions":["Correct the go-import meta tag's subdirectory to be a clean relative path with no leading '/' or '-'","Leave the subdirectory empty if the module root equals the repo root"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate a go-import subdirectory the same way cmd/go does\nfunc validSubDir(s string) error {\n  if s == \"\" { return nil }\n  if s[0] == '/' { return errors.New(\"leading slash\") }\n  if s[0] == '-' { return errors.New(\"leading hyphen\") }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the subdirectory field empty unless the module lives in a repo subdir","Never start the subdirectory with '/' or '-'"],"tags":["go","modules","vcs","vanity","security"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}