{"record":{"id":"d6f6a6f1e6c25946","repo":"vercel/turborepo","slug":"directory-path-contains-potentially-unsafe-charact","errorCode":null,"errorMessage":"Directory path contains potentially unsafe characters: ${dir}","messagePattern":"Directory path contains potentially unsafe characters: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/create-turbo/src/utils/git.ts","lineNumber":36,"sourceCode":"*.pem\n\n# debug\nnpm-debug.log*\nyarn-debug.log*\nyarn-error.log*\n\n# turbo\n.turbo\n\n# vercel\n.vercel\n`;\n\nconst SHELL_METACHARACTERS = /[`$(){}|;&<>!#]/;\n\nfunction assertSafeDirectory(dir: string): void {\n  if (SHELL_METACHARACTERS.test(dir)) {\n    throw new Error(\n      `Directory path contains potentially unsafe characters: ${dir}`\n    );\n  }\n}\n\nfunction git(args: Array<string>, cwd: string): boolean {\n  const result = spawnSync(\"git\", args, { stdio: \"ignore\", cwd });\n  if (result.status !== 0) {\n    throw new Error(`git ${args[0]} failed`);\n  }\n  return true;\n}\n\nfunction isInGitRepository(root: string): boolean {\n  try {\n    git([\"rev-parse\", \"--is-inside-work-tree\"], root);\n    return true;\n  } catch (_) {","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/vercel/turborepo/blob/f9245100cf0d31d96628804ead485f6bf226e55a/packages/create-turbo/src/utils/git.ts#L18-L54","documentation":"Before create-turbo runs git commands in your new project, it validates the install path against shell metacharacters. This Error is thrown when the directory contains any of backtick, dollar, parentheses, braces, pipe, semicolon, ampersand, angle brackets, exclamation mark, or hash. The guard prevents command injection through user-supplied paths passed as cwd to git.","triggerScenarios":"The project name or install path you gave create-turbo contains a character matched by /[`$(){}|;&<>!#]/. Examples: my$app, demo(1), a;b, team#proj. tryGitInit calls assertSafeDirectory with the root path and the check fails before any git command runs.","commonSituations":"Naming a project after a branch or issue that contains #, such as feat#123. Using parentheses in versioned folder names like app(2). CI workspaces created under paths with special characters. Copy-paste paths that include shell syntax.","solutions":["Rename the target directory so it uses only letters, digits, dash, underscore, and dot","Re-run create-turbo and answer the project name and install path prompts without #, $, parentheses, or other special characters","If you need that exact path later, scaffold into a safe name first, then rename after create-turbo finishes"],"exampleFix":"# before: path with metacharacters\nnpx create-turbo@latest \"my-app(v2)\"\n# after: safe path\nnpx create-turbo@latest my-app-v2","handlingStrategy":"validation","validationCode":"const UNSAFE = /[`$(){}|;&<>!#]/;\n\n// reject unsafe names before they reach create-turbo prompts or scripts\nfunction isSafeDirectoryPath(dir: string): boolean {\n  return !UNSAFE.test(dir);\n}\n\nif (!isSafeDirectoryPath(projectDir)) {\n  throw new Error(\"Project path may only contain letters, digits, dash, underscore, dot\");\n}","typeGuard":"function isSafeDirectoryName(name: string): boolean {\n  return !/[`$(){}|;&<>!#]/.test(name);\n}","tryCatchPattern":null,"preventionTips":["Restrict project names to letters, digits, dash, underscore, and dot","Validate CI workspace paths with the same character rule","Never embed branch names, issue tags, or shell syntax into directory names"],"tags":["create-turbo","security","validation","path","git","command-injection"],"backgroundTag":"unsafe-path-characters","analyzedSha":"f9245100cf0d31d96628804ead485f6bf226e55a","analyzedAt":"2026-08-17T10:46:15.696Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}