{"record":{"id":"bf56ad95d50f1184","repo":"nodejs/node","slug":"invalid-name-s","errorCode":null,"errorMessage":"Invalid name '%s'","messagePattern":"Invalid name '(.+?)'","errorType":"validation","errorClass":"WebParameterError","httpStatus":null,"severity":"warning","filePath":"deps/v8/tools/grokdump.py","lineNumber":3707,"sourceCode":"\n  def set_dump_desc(self, name, description):\n    if not DUMP_FILE_RE.match(name):\n      return False\n    fname = os.path.join(self.dumppath, name)\n    if not os.path.isfile(fname):\n      return False\n    fname = fname + \".desc\"\n    descfile = open(fname, \"w\")\n    descfile.write(description)\n    descfile.close()\n    return True\n\n  def get_dump_formatter(self, name):\n    if name is None:\n      return self.default_formatter\n    else:\n      if not DUMP_FILE_RE.match(name):\n        raise WebParameterError(\"Invalid name '%s'\" % name)\n      formatter = self.formatters.get(name, None)\n      if formatter is None:\n        try:\n          formatter = InspectionWebFormatter(\n              self.switches, os.path.join(self.dumppath, name), self)\n          self.formatters[name] = formatter\n        except IOError:\n          raise WebParameterError(\"Could not open dump '%s'\" % name)\n      return formatter\n\n  def output_dumps(self, f):\n    f.write(WEB_DUMPS_HEADER)\n    f.write(\"<h3>List of available dumps</h3>\")\n    f.write(\"<table class=\\\"dumplist\\\">\\n\")\n    f.write(\"<thead><tr>\")\n    f.write(\"<th>Name</th>\")\n    f.write(\"<th>File time</th>\")\n    f.write(\"<th>Comment</th>\")","sourceCodeStart":3689,"sourceCodeEnd":3725,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/v8/tools/grokdump.py#L3689-L3725","documentation":"grokdump.py's web server endpoint resolves a requested dump formatter by name. get_dump_formatter() rejects any name that does not match DUMP_FILE_RE (re.compile(r\"[-_0-9a-zA-Z][-\\._0-9a-zA-Z]*\\.dmp$\")) by raising WebParameterError. This is a security-oriented validation: names must start with a safe char, contain only [A-Za-z0-9_.-], and end in `.dmp`, blocking path traversal and arbitrary file access.","triggerScenarios":"An HTTP request to the grokdump web UI supplies a dump `name` query parameter with a bad extension (e.g. `heapdump`, `.heapsnapshot`), disallowed characters (slashes, `..`), or an empty/leading-dot name. The regex test fails and WebParameterError is raised, surfaced as an HTTP 400.","commonSituations":"User types a dump name without the .dmp suffix in the web form; automated client posts a `.heapsnapshot` filename expecting it to work; attempted path-traversal (`../../etc/passwd`) is correctly blocked here.","solutions":["Ensure the requested name ends in `.dmp` and contains only letters, digits, underscore, hyphen, or dot (e.g. `my-heap.001.dmp`).","Do not include directory separators or a leading dot; the server resolves names under a fixed dumppath.","If you have a `.heapsnapshot`, first convert/export it to the V8 `.dmp` format the inspector expects."],"exampleFix":"// before\n  ?name=heapshot               // 400 Invalid name 'heapshot'\n// after\n  ?name=heapshot.dmp           // matches DUMP_FILE_RE","handlingStrategy":"validation","validationCode":"import re\nDUMP_FILE_RE = re.compile(r\"[-_0-9a-zA-Z][-\\._0-9a-zA-Z]*\\.dmp$\")\nif not name or not DUMP_FILE_RE.match(name):\n    return 'Invalid name; must match [-_0-9a-zA-Z][-\\._0-9a-zA-Z]*.dmp', 400","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Sanitize dump names client-side: alphanumeric, underscore, hyphen, dot, ending in .dmp.","Never send directory separators or a leading dot in the name parameter.","Convert .heapsnapshot to .dmp before requesting it through the grokdump web UI."],"tags":["web","validation","security","grokdump","path-traversal"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}