{"record":{"id":"afd099f8273be50d","repo":"Tencent/WeKnora","slug":"invalid-arguments-w","errorCode":null,"errorMessage":"invalid arguments: %w","messagePattern":"invalid arguments: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":638,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains potentially dangerous pattern\", key)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// ValidateStdioConfig performs comprehensive validation of stdio configuration\n// This should be called before creating or executing any stdio-based MCP client\nfunc ValidateStdioConfig(command string, args []string, envVars map[string]string) error {\n\t// Validate command\n\tif err := ValidateStdioCommand(command); err != nil {\n\t\treturn fmt.Errorf(\"invalid command: %w\", err)\n\t}\n\n\t// Validate arguments\n\tif err := ValidateStdioArgs(args); err != nil {\n\t\treturn fmt.Errorf(\"invalid arguments: %w\", err)\n\t}\n\n\t// Validate environment variables\n\tif err := ValidateStdioEnvVars(envVars); err != nil {\n\t\treturn fmt.Errorf(\"invalid environment variables: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// SSRFSafeHTTPClientConfig contains configuration for the SSRF-safe HTTP client\ntype SSRFSafeHTTPClientConfig struct {\n\tTimeout            time.Duration\n\tMaxRedirects       int\n\tDisableKeepAlives  bool\n\tDisableCompression bool\n}\n","sourceCodeStart":620,"sourceCodeEnd":656,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L620-L656","documentation":"ValidateStdioConfig wraps any error from ValidateStdioArgs with 'invalid arguments: %w'. The wrapped error carries the specific reason (e.g. an argument matched a dangerous shell-injection pattern). It is a defensive gate ensuring argv entries cannot be abused as shell syntax.","triggerScenarios":"Calling ValidateStdioConfig with args containing entries that match DangerousArgPatterns — e.g. backticks, $(), command separators — or otherwise failing ValidateStdioArgs.","commonSituations":"Args copied from a shell command line (containing ;, |, &&, redirections), dynamically built args from untrusted input, or flags pasted as one string.","solutions":["Inspect the wrapped inner error to identify which argument failed and why.","Remove shell metacharacters from arguments; pass plain tokens only.","Split combined shell strings into individual argv entries.","Sanitize user-supplied input before placing it in args."],"exampleFix":"// before\nerr := secutils.ValidateStdioConfig(\"node\", []string{\"server.js; rm -rf /\"}, env)\n// after\nerr := secutils.ValidateStdioConfig(\"node\", []string{\"server.js\"}, env)","handlingStrategy":"validation","validationCode":"for _, a := range args {\n    if strings.ContainsAny(a, \";|&`$><\") { return fmt.Errorf(\"argument rejected: %q\", a) }\n}","typeGuard":"func areSafeArgs(args []string) bool {\n    for _, a := range args {\n        if strings.ContainsAny(a, \";|&`$><\") { return false }\n    }\n    return true\n}","tryCatchPattern":"if err := secutils.ValidateStdioConfig(cmd, args, env); err != nil {\n    if strings.Contains(err.Error(), \"invalid arguments\") {\n        return fmt.Errorf(\"check args for shell metacharacters: %w\", err)\n    }\n}","preventionTips":["Pass each argument as a separate slice element, never one joined string.","Sanitize user input before it lands in args.","Avoid copying raw shell command lines into args."],"tags":["security","validation","stdio","arguments"],"backgroundTag":"invalid-command","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}