{"record":{"id":"b29aa1bf7d034eb0","repo":"Tencent/WeKnora","slug":"environment-variable-name-s-exceeds-maximum-len","errorCode":null,"errorMessage":"environment variable name '%s' exceeds maximum length","messagePattern":"environment variable name '(.+?)' exceeds maximum length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":604,"sourceCode":"\n// ValidateStdioEnvVars validates environment variables for MCP stdio transport\n// Returns an error if any env var name or value is dangerous\nfunc ValidateStdioEnvVars(envVars map[string]string) error {\n\tif len(envVars) == 0 {\n\t\treturn nil\n\t}\n\n\tfor key, value := range envVars {\n\t\t// Check key against dangerous patterns\n\t\tfor _, pattern := range DangerousEnvVarPatterns {\n\t\t\tif pattern.MatchString(key) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' is not allowed for security reasons\", key)\n\t\t\t}\n\t\t}\n\n\t\t// Check key length\n\t\tif len(key) > 256 {\n\t\t\treturn fmt.Errorf(\"environment variable name '%s' exceeds maximum length\", SanitizeForLog(key[:50]))\n\t\t}\n\n\t\t// Check value length\n\t\tif len(value) > 4096 {\n\t\t\treturn fmt.Errorf(\"environment variable '%s' value exceeds maximum length\", key)\n\t\t}\n\n\t\t// Check for null bytes in value\n\t\tif strings.Contains(value, \"\\x00\") {\n\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains null bytes\", key)\n\t\t}\n\n\t\t// Check value for shell injection patterns\n\t\tfor _, pattern := range DangerousArgPatterns {\n\t\t\tif pattern.MatchString(value) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains potentially dangerous pattern\", key)\n\t\t\t}\n\t\t}","sourceCodeStart":586,"sourceCodeEnd":622,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L586-L622","documentation":"ValidateStdioEnvVars limits environment-variable NAME length to 256 characters. Overly long names are rejected to prevent abuse and platform limitations. Note the message logs only the first 50 characters (SanitizeForLog(key[:50])).","triggerScenarios":"ValidateStdioConfig called with an env map containing a key longer than 256 bytes — usually from malformed configs or generated keys.","commonSituations":"Copy-paste errors where a value was accidentally placed in the key position (\"API_KEY=secret\" pasted as a whole line); programmatically generated env keys embedding long identifiers; corrupted config files.","solutions":["Shorten the variable name to a conventional short identifier (<=256 chars, typically <64)","Check whether a value was accidentally placed as a key (key containing '=' or very long text) and restructure the map","Validate env keys against ^[A-Za-z_][A-Za-z0-9_]*$ before building the config"],"exampleFix":"// before\n\"env\": {\"MY_VERY_LONGGenerated_KEY_NAME_that_goes_on_and_on_for_300_chars...\": \"v\"}\n// after\n\"env\": {\"MY_KEY\": \"v\"}","handlingStrategy":"validation","validationCode":"for k := range cfg.Env {\n    if len(k) > 256 {\n        return fmt.Errorf(\"env key too long (%d > 256): %.50q\", len(k), k)\n    }\n    if !regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`).MatchString(k) {\n        return fmt.Errorf(\"env key %q is not a valid identifier\", k)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := ValidateStdioConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"exceeds maximum length\") {\n        return fmt.Errorf(\"fix env map — a value was likely placed in the key position: %w\", err)\n    }\n    return err\n}","preventionTips":["Use conventional short env var names","Check for paste errors where 'KEY=value' was inserted as a whole key","Validate keys with an identifier regex before building the config"],"tags":["validation","env-vars","mcp","stdio","limits"],"backgroundTag":"env-var-name-too-long","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}