{"record":{"id":"cf206e09537ad2bc","repo":"Billionmail/BillionMail","slug":"configuration-value-contains-illegal-characters","errorCode":null,"errorMessage":"configuration value contains illegal characters","messagePattern":"configuration value contains illegal characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/internal/controller/settings/settings.go","lineNumber":245,"sourceCode":"\t\tif !public.IsValidTimezone(value) {\n\t\t\treturn fmt.Errorf(\"invalid timezone\")\n\t\t}\n\n\tcase \"FAIL2BAN_INIT\", \"fail2ban\":\n\t\t// fail2ban: only allowed y/n or 1/0\n\t\tif value != \"y\" && value != \"n\" && value != \"1\" && value != \"0\" {\n\t\t\treturn fmt.Errorf(\"fail2ban value can only be y/n or 1/0\")\n\t\t}\n\tcase \"RETENTION_DAYS\", \"retention_days\":\n\t\t// retention_days: must be a number\n\t\tif _, err := strconv.Atoi(value); err != nil {\n\t\t\treturn fmt.Errorf(\"retention_days must be a number\")\n\t\t}\n\t}\n\n\t// General character check: not allowed dangerous characters\n\tif public.ContainsDangerousChars(value) {\n\t\treturn fmt.Errorf(\"configuration value contains illegal characters\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":227,"sourceCodeEnd":250,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/controller/settings/settings.go#L227-L250","documentation":"After key-specific checks pass, validateConfigValue runs a general safety check with public.ContainsDangerousChars and rejects any value containing characters considered dangerous (typically shell/command-injection metacharacters). Because config values are interpolated into service config files and shell-managed deployment steps, these characters could enable injection.","triggerScenarios":"Any config value containing metacharacters such as ; | & $ ` \\ \" ' newlines or redirection operators — even for keys that have no dedicated format validator.","commonSituations":"Users paste shell snippets into config fields, include quoting around values ('\"mail.example.com\"'), or values carry trailing newline characters from clipboard copies.","solutions":["Remove shell metacharacters from the value and save only the bare token","Strip surrounding quotes and whitespace before calling the API","Sanitize on the client side with a whitelist regex per config key","If a legitimate value needs such a character, use the supported alternative syntax (e.g. CIDR or FQDN formats)"],"exampleFix":"// before\nBILLIONMAIL_HOSTNAME = \"mail.example.com\"; rm -rf /\n// after\nBILLIONMAIL_HOSTNAME = mail.example.com","handlingStrategy":"validation","validationCode":"const dangerous = /[;&|`$\\\\<>\"'\\n\\r]/;\nif (dangerous.test(value)) throw new Error('configuration value contains illegal characters');","typeGuard":null,"tryCatchPattern":"try {\n  await api.setSystemConfigKey(key, value);\n} catch (e) {\n  if (String(e.message).includes('illegal characters')) {\n    notify('Remove shell metacharacters (;, |, &, $, backticks, quotes) from the value');\n  } else throw e;\n}","preventionTips":["Whitelist-validate each config key's expected format before submit","Strip surrounding quotes and trailing newlines from pasted input","Never paste shell commands into config fields","Treat this error as a potential injection attempt — audit the input source"],"tags":["validation","security","injection","config"],"backgroundTag":"illegal-characters-in-config","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}