{"record":{"id":"d765a1fe123e03a9","repo":"Tencent/WeKnora","slug":"command-cannot-be-empty","errorCode":null,"errorMessage":"command cannot be empty","messagePattern":"command cannot be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":535,"sourceCode":"\n// DangerousEnvVarPatterns contains patterns for dangerous environment variable names or values\nvar DangerousEnvVarPatterns = []*regexp.Regexp{\n\tregexp.MustCompile(`(?i)^LD_PRELOAD$`),      // Library injection\n\tregexp.MustCompile(`(?i)^LD_LIBRARY_PATH$`), // Library path manipulation\n\tregexp.MustCompile(`(?i)^DYLD_`),            // macOS dynamic linker\n\tregexp.MustCompile(`(?i)^PATH$`),            // PATH manipulation\n\tregexp.MustCompile(`(?i)^PYTHONPATH$`),      // Python path manipulation\n\tregexp.MustCompile(`(?i)^NODE_OPTIONS$`),    // Node.js options injection\n\tregexp.MustCompile(`(?i)^BASH_ENV$`),        // Bash environment file\n\tregexp.MustCompile(`(?i)^ENV$`),             // Shell environment file\n\tregexp.MustCompile(`(?i)^SHELL$`),           // Shell override\n}\n\n// ValidateStdioCommand validates the command for MCP stdio transport\n// Returns an error if the command is not in the whitelist or contains dangerous patterns\nfunc ValidateStdioCommand(command string) error {\n\tif command == \"\" {\n\t\treturn fmt.Errorf(\"command cannot be empty\")\n\t}\n\n\t// Normalize command (extract base name if it's a path)\n\tbaseCommand := command\n\tif strings.Contains(command, \"/\") {\n\t\tparts := strings.Split(command, \"/\")\n\t\tbaseCommand = parts[len(parts)-1]\n\t}\n\n\t// Check against whitelist\n\tif !AllowedStdioCommands[baseCommand] {\n\t\treturn fmt.Errorf(\"command '%s' is not in the allowed list. Allowed commands: uvx, npx, node, python, python3, deno, bun\", baseCommand)\n\t}\n\n\t// Additional check: command should not contain path traversal\n\tif strings.Contains(command, \"..\") {\n\t\treturn fmt.Errorf(\"command path contains invalid characters\")\n\t}","sourceCodeStart":517,"sourceCodeEnd":553,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L517-L553","documentation":"ValidateStdioCommand validates the command used for MCP stdio transport. It rejects an empty command string before any whitelist or pattern checks run. Stdio transport spawns a local process, so a concrete command is mandatory.","triggerScenarios":"Calling ValidateStdioCommand (via ValidateStdioConfig) with an empty string command, typically from an MCP server config where the \"command\" field is missing, blank, or only whitespace was trimmed elsewhere but not here.","commonSituations":"Config file with \"command\": \"\"; JSON/YAML key typo leaving the field unset; environment-driven config where a required env var was empty; programmatic config construction skipping the command field.","solutions":["Set a valid command in the MCP stdio config (e.g. \"npx\", \"uvx\", \"node\")","Check that the config file/JSON actually populates the command field and the key name is correct","If the command comes from an env var, verify it is set and non-empty before building the config"],"exampleFix":"// before\n{\"mcpServers\": {\"fetch\": {\"command\": \"\", \"args\": [\"mcp-server-fetch\"]}}}\n// after\n{\"mcpServers\": {\"fetch\": {\"command\": \"uvx\", \"args\": [\"mcp-server-fetch\"]}}}","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(cfg.Command) == \"\" {\n    return fmt.Errorf(\"mcp stdio config requires a non-empty command\")\n}\nerr := ValidateStdioConfig(cfg)","typeGuard":null,"tryCatchPattern":"if err := ValidateStdioConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"command cannot be empty\") {\n        return fmt.Errorf(\"config error: mcpServers[%q].command is missing\", name)\n    }\n    return err\n}","preventionTips":["Validate required config fields (command) at config-load time","Give defaults in config schemas or fail fast with field-level messages","Check for key typos when a command field appears empty"],"tags":["validation","mcp","stdio","config"],"backgroundTag":"empty-command-validation","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}