{"record":{"id":"bf7a75c776ac8cfd","repo":"golang/go","slug":"invalid-input-file-name-q","errorCode":null,"errorMessage":"invalid input file name %q","messagePattern":"invalid input file name %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/load/pkg.go","lineNumber":2043,"sourceCode":"\t// where two different input files have equal names under a case-insensitive\n\t// comparison.\n\tinputs := p.AllFiles()\n\tf1, f2 := str.FoldDup(inputs)\n\tif f1 != \"\" {\n\t\tsetError(fmt.Errorf(\"case-insensitive file name collision: %q and %q\", f1, f2))\n\t\treturn\n\t}\n\n\t// If first letter of input file is ASCII, it must be alphanumeric.\n\t// This avoids files turning into flags when invoking commands,\n\t// and other problems we haven't thought of yet.\n\t// Also, _cgo_ files must be generated by us, not supplied.\n\t// They are allowed to have //go:cgo_ldflag directives.\n\t// The directory scan ignores files beginning with _,\n\t// so we shouldn't see any _cgo_ files anyway, but just be safe.\n\tfor _, file := range inputs {\n\t\tif !SafeArg(file) || strings.HasPrefix(file, \"_cgo_\") {\n\t\t\tsetError(fmt.Errorf(\"invalid input file name %q\", file))\n\t\t\treturn\n\t\t}\n\t}\n\tif name := pathpkg.Base(p.ImportPath); !SafeArg(name) {\n\t\tsetError(fmt.Errorf(\"invalid input directory name %q\", name))\n\t\treturn\n\t}\n\tif strings.ContainsAny(p.Dir, \"\\r\\n\") {\n\t\tsetError(fmt.Errorf(\"invalid package directory %q\", p.Dir))\n\t\treturn\n\t}\n\n\t// Build list of imported packages and full dependency list.\n\timports := make([]*Package, 0, len(p.Imports))\n\tfor i, path := range importPaths {\n\t\tif path == \"C\" {\n\t\t\tcontinue\n\t\t}","sourceCodeStart":2025,"sourceCodeEnd":2061,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/load/pkg.go#L2025-L2061","documentation":"Every input file in a Go package must have a name that is safe to pass as a subprocess command-line argument. The SafeArg check requires the first byte to be alphanumeric (0-9, A-Z, a-z), '.', '_', '/', or a non-ASCII byte (>= 0x80 / utf8.RuneSelf). Files starting with '-' could be misinterpreted as flags by invoked compilers. Additionally, files starting with '_cgo_' are rejected because that prefix is reserved for toolchain-generated cgo outputs.","triggerScenarios":"A file in the package directory starts with '-', '=', or another special ASCII character (e.g., a file named '-helper.go'). Or a file starts with '_cgo_' (e.g., '_cgo_main.c') that was not generated by the Go toolchain's cgo tool. The SafeArg function at pkg.go:2667 defines the allowed first-character set.","commonSituations":"Accidentally creating files with names starting with '-' or other special characters via scripts or typos. Manually adding files with '_cgo_' prefix instead of letting cgo generate them. Files created by external tools with unusual naming conventions. Renaming files and introducing problematic first characters.","solutions":["Rename the file so its first character is alphanumeric, a dot, underscore, or slash.","Remove any '_cgo_' prefixed files that were not generated by the Go toolchain's cgo tool.","If the file is not a source file needed for the build, move it out of the package directory.","Check for files created by accident: ls -la | grep '^-'"],"exampleFix":"# before — filename starts with dash\nmv -- -options.go options.go\n# after — valid first character\n# (file is now named 'options.go')","handlingStrategy":"validation","validationCode":"// Validate that all package input files have safe names.\nfunc safeArg(name string) bool {\n    if name == \"\" {\n        return false\n    }\n    c := name[0]\n    return '0' <= c && c <= '9' || 'A' <= c && c <= 'Z' || 'a' <= c && c <= 'z' ||\n        c == '.' || c == '_' || c == '/' || c >= utf8.RuneSelf\n}\n\nfunc validatePackageFiles(files []string) error {\n    for _, f := range files {\n        if !safeArg(f) {\n            return fmt.Errorf(\"invalid input file name %q (first char not allowed)\", f)\n        }\n        if strings.HasPrefix(f, \"_cgo_\") {\n            return fmt.Errorf(\"invalid input file name %q (_cgo_ prefix reserved)\", f)\n        }\n    }\n    return nil\n}","typeGuard":"// Check whether a filename is safe for the Go build system.\nfunc isSafeFileName(name string) bool {\n    if name == \"\" || strings.HasPrefix(name, \"_cgo_\") {\n        return false\n    }\n    c := name[0]\n    return '0' <= c && c <= '9' || 'A' <= c && c <= 'Z' || 'a' <= c && c <= 'z' ||\n        c == '.' || c == '_' || c == '/' || c >= 0x80\n}","tryCatchPattern":null,"preventionTips":["Ensure filenames start with alphanumeric characters, dots, or underscores.","Never manually create _cgo_ prefixed files — let the cgo toolchain generate them.","Add a pre-commit hook that rejects filenames starting with special characters.","Audit scripts and code generators that produce files in package directories."],"tags":["go","go-build","filenames","validation","security","command-injection"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}