{"record":{"id":"cc0745deb2e83aa4","repo":"kovidgoyal/kitty","slug":"invalid-data-uri-no-comma-found","errorCode":null,"errorMessage":"invalid data URI: no comma found","messagePattern":"invalid data URI: no comma found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kittens/dnd/drop.go","lineNumber":391,"sourceCode":"\tpath string // for file URIs: the local filesystem path (empty if not a valid file URI)\n\tmime string // for data URIs: the MIME type\n\tdata []byte // for data URIs: the decoded payload\n}\n\n// ext_for_mime returns a file extension (with leading dot) for a MIME type.\nfunc ext_for_mime(mime string) string {\n\tfor _, x := range utils.GuessFileExtensions(mime) {\n\t\treturn x\n\t}\n\treturn \"\"\n}\n\n// parse_data_uri decodes a data: URI and returns the MIME type and raw data.\nfunc parse_data_uri(uri string) (mime string, data []byte, err error) {\n\trest := strings.TrimPrefix(uri, \"data:\")\n\tcomma_idx := strings.Index(rest, \",\")\n\tif comma_idx < 0 {\n\t\terr = fmt.Errorf(\"invalid data URI: no comma found\")\n\t\treturn\n\t}\n\theader := rest[:comma_idx]\n\tpayload := rest[comma_idx+1:]\n\n\tis_base64 := strings.HasSuffix(header, \";base64\")\n\tif is_base64 {\n\t\theader = header[:len(header)-7]\n\t}\n\n\tmime = strings.TrimSpace(header)\n\tif mime == \"\" {\n\t\tmime = \"text/plain\"\n\t}\n\t// Strip parameters (e.g. ;charset=UTF-8) so the MIME type is clean.\n\tmime, _, _ = strings.Cut(mime, \";\")\n\n\tif is_base64 {","sourceCodeStart":373,"sourceCodeEnd":409,"githubUrl":"https://github.com/kovidgoyal/kitty/blob/6d5d0c440603ad9bdf6dcd599f73f6dde21acb44/kittens/dnd/drop.go#L373-L409","documentation":"parse_data_uri was given a data: URI that contains no comma separating the header (MIME[;base64]) from the payload, so it cannot be decoded. It is hit when parsing a uri-list from a drop that contains a malformed data: URI.","triggerScenarios":"A dropped text/uri-list contains an entry like 'data:text/plain' with no ',' — parse_uri_list calls parse_data_uri which fails on strings.Index(rest, \",\") < 0.","commonSituations":"A source application generated a truncated/malformed data: URI; user hand-crafted a URI list missing the comma; copy/paste truncation of long data URIs.","solutions":["Fix the source data: URI to include a comma, e.g. 'data:text/plain;base64,SGVsbG8=' or 'data:,hello'","Validate/sanitize URI lists before feeding them to the drop path","Handle the error at the caller and skip the offending URI instead of aborting the whole drop"],"exampleFix":"// before\n\"data:text/plain\"\n// after\n\"data:text/plain,hello\"","handlingStrategy":"validation","validationCode":"func validDataURI(s string) bool {\n\trest := strings.TrimPrefix(s, \"data:\")\n\treturn strings.Contains(rest, \",\")\n}","typeGuard":null,"tryCatchPattern":"Skip malformed entries and continue processing the rest of the uri-list rather than failing the whole drop.","preventionTips":["Validate data: URIs at the producer side","Reject uri-list entries without a comma before feeding them to the drop pipeline"],"tags":["dnd","data-uri","parsing","drop"],"backgroundTag":"malformed-uri","analyzedSha":"6d5d0c440603ad9bdf6dcd599f73f6dde21acb44","analyzedAt":"2026-08-27T14:20:20.142Z","schemaVersion":2},"datasetVersion":"2026-08-27T19:17:21.184Z"}