{"record":{"id":"cd0bbb2f0827c440","repo":"Tencent/WeKnora","slug":"argument-d-exceeds-maximum-length-1024-character","errorCode":null,"errorMessage":"argument %d exceeds maximum length (1024 characters)","messagePattern":"argument (.+?) exceeds maximum length \\(1024 characters\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":568,"sourceCode":"\t// Additional check: command should not contain path traversal\n\tif strings.Contains(command, \"..\") {\n\t\treturn fmt.Errorf(\"command path contains invalid characters\")\n\t}\n\n\treturn nil\n}\n\n// ValidateStdioArgs validates the arguments for MCP stdio transport\n// Returns an error if any argument contains dangerous patterns\nfunc ValidateStdioArgs(args []string) error {\n\tif len(args) == 0 {\n\t\treturn nil\n\t}\n\n\tfor i, arg := range args {\n\t\t// Check length\n\t\tif len(arg) > 1024 {\n\t\t\treturn fmt.Errorf(\"argument %d exceeds maximum length (1024 characters)\", i)\n\t\t}\n\n\t\t// Check against dangerous patterns\n\t\tfor _, pattern := range DangerousArgPatterns {\n\t\t\tif pattern.MatchString(arg) {\n\t\t\t\treturn fmt.Errorf(\"argument %d contains potentially dangerous pattern: %s\", i, SanitizeForLog(arg))\n\t\t\t}\n\t\t}\n\n\t\t// Check for null bytes\n\t\tif strings.Contains(arg, \"\\x00\") {\n\t\t\treturn fmt.Errorf(\"argument %d contains null bytes\", i)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":550,"sourceCodeEnd":586,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L550-L586","documentation":"ValidateStdioArgs limits each argument for MCP stdio transport to 1024 characters. This prevents oversized arguments from being used for buffer abuse, command-line injection payloads, or accidental resource exhaustion. The index of the offending argument (0-based) is included in the message.","triggerScenarios":"ValidateStdioConfig called with an args array where at least one element is longer than 1024 bytes (len(arg) in Go counts bytes, so multibyte UTF-8 hits the limit sooner).","commonSituations":"Passing long inline scripts (node -e, python -c) as arguments; embedding large URLs, tokens, or base64 blobs in args; configs generated programmatically that concatenate many values into one arg.","solutions":["Shorten the argument: move long payloads into a file or env var and pass the path/var name instead","For inline code, write it to a temp script file and pass the file path as the argument","Split oversized arguments into multiple smaller arguments if the target program supports it","Use environment variables (validated separately, 4096-char limit) for long values"],"exampleFix":"// before\n\"args\": [\"-e\", \"<1500-char inline script>\"]\n// after\n\"args\": [\"/tmp/mcp-script.js\"] // script content moved to file","handlingStrategy":"validation","validationCode":"for i, a := range cfg.Args {\n    if len(a) > 1024 {\n        return fmt.Errorf(\"args[%d] too long (%d > 1024)\", i, len(a))\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := ValidateStdioConfig(cfg); err != nil {\n    var tooLongErr string = \"exceeds maximum length\"\n    if strings.Contains(err.Error(), tooLongErr) {\n        return fmt.Errorf(\"shorten stdio args or move payload to a file: %w\", err)\n    }\n    return err\n}","preventionTips":["Pass long payloads via files or env vars, not argv","Keep inline -e/-c scripts short; write them to temp files instead","Pre-check generated args for length before persisting configs"],"tags":["validation","mcp","stdio","args","limits"],"backgroundTag":"argument-too-long","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}