{"record":{"id":"b45f4a78df5cf8cb","repo":"golang/go","slug":"invalid-command-line-argument-s-in-command-s","errorCode":null,"errorMessage":"invalid command-line argument %s in command: %s","messagePattern":"invalid command-line argument (.+?) in command: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/work/shell.go","lineNumber":598,"sourceCode":"\t}\n\treturn sh.reportCmd(desc, dir, out, err)\n}\n\n// runOut runs the command given by cmdline in the directory dir.\n// It returns the command output and any errors that occurred.\n// It accumulates execution time in a.\nfunc (sh *Shell) runOut(dir string, env []string, cmdargs ...any) ([]byte, error) {\n\ta := sh.action\n\n\tcmdline := str.StringList(cmdargs...)\n\n\tfor _, arg := range cmdline {\n\t\t// GNU binutils commands, including gcc and gccgo, interpret an argument\n\t\t// @foo anywhere in the command line (even following --) as meaning\n\t\t// \"read and insert arguments from the file named foo.\"\n\t\t// Don't say anything that might be misinterpreted that way.\n\t\tif strings.HasPrefix(arg, \"@\") {\n\t\t\treturn nil, fmt.Errorf(\"invalid command-line argument %s in command: %s\", arg, joinUnambiguously(cmdline))\n\t\t}\n\t}\n\n\tif cfg.BuildN || cfg.BuildX {\n\t\tvar envcmdline string\n\t\tfor _, e := range env {\n\t\t\tif j := strings.IndexByte(e, '='); j != -1 {\n\t\t\t\tif strings.ContainsRune(e[j+1:], '\\'') {\n\t\t\t\t\tenvcmdline += fmt.Sprintf(\"%s=%q\", e[:j], e[j+1:])\n\t\t\t\t} else {\n\t\t\t\t\tenvcmdline += fmt.Sprintf(\"%s='%s'\", e[:j], e[j+1:])\n\t\t\t\t}\n\t\t\t\tenvcmdline += \" \"\n\t\t\t}\n\t\t}\n\t\tenvcmdline += joinUnambiguously(cmdline)\n\t\tsh.ShowCmd(dir, \"%s\", envcmdline)\n\t\tif cfg.BuildN {","sourceCodeStart":580,"sourceCodeEnd":616,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/work/shell.go#L580-L616","documentation":"Thrown by Shell.runOut when any argument in the command line passed to an external tool (gcc, ld, pkg-config, etc.) starts with `@`. GNU binutils interpret `@file` as \"read more args from this file\", which can be exploited via crafted filenames and is hard to escape safely, so the go command rejects such arguments outright.","triggerScenarios":"A cgo build assembles a command line where some flag value or source path begins with `@` — e.g. CGO_CFLAGS contains `-I@incdir`, a source filename is `@evil`, or a generated response file leaks into an argument slot. runOut scans cmdline and returns before exec.","commonSituations":"A build system that emits `@file` response-file syntax into CGO flags; a filename or temp path that legitimately starts with `@`; a vendored C package whose #cgo line references an `@`-prefixed include; malicious/sanitized-fuzz input producing `@`-prefixed paths.","solutions":["Remove or rewrite any `@`-prefixed token in CGO_CFLAGS/CGO_LDFLAGS/#cgo directives.","If a real path starts with `@`, rename it so it does not.","Audit the offending source printed in the error (the full command is shown) to locate the `@` token.","Avoid response-file (`@file`) conventions in cgo flags; pass flags inline."],"exampleFix":"// before\n// #cgo CFLAGS: -I@root/include\n\n// after\n// #cgo CFLAGS: -I./include","handlingStrategy":"validation","validationCode":"// Reject @-prefixed tokens in cgo flags before building\nfor _, env := range []string{\"CGO_CFLAGS\", \"CGO_LDFLAGS\", \"CGO_CPPFLAGS\", \"CGO_CXXFLAGS\"} {\n    for _, f := range strings.Fields(os.Getenv(env)) {\n        if strings.HasPrefix(f, \"@\") {\n            log.Fatalf(\"remove @-prefixed token %q from %s\", f, env)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never embed response-file (@file) syntax in cgo flags.","Rename any source/include path that starts with @.","Audit generated flag lists for stray @ tokens."],"tags":["go-toolchain","cgo","security","command-injection","flags"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}