{"record":{"id":"d8036c8cc1e1be84","repo":"NationalSecurityAgency/ghidra","slug":"bad-characters-in-one-or-more-proposed-type","errorCode":null,"errorMessage":"Bad characters in one or more proposed {type}","messagePattern":"Bad characters in one or more proposed (.+?)","errorType":"validation","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java","lineNumber":2167,"sourceCode":"\t\t}\n\t\tif (query.info.execats != null) {\n\t\t\tcheckStrings(query.info.execats, \"categories\", -1);\n\t\t\tconfig.info.execats = query.info.execats;\n\t\t}\n\t\tgenerate(config);\n\t\tresponse.info = config.info;\n\t}\n\n\tprivate static void checkStrings(List<String> list, String type, int limit)\n\t\t\tthrows LSHException {\n\t\tif (limit > 0 && list.size() > limit) {\n\t\t\tthrow new LSHException(\"Too many \" + type + \" specified (limit=\" +\n\t\t\t\tFunctionTagBSimFilterType.MAX_TAG_COUNT + \"): \" + list.size());\n\t\t}\n\t\tSet<String> names = new HashSet<>();\n\t\tfor (String name : list) {\n\t\t\tif (!CategoryRecord.enforceTypeCharacters(name)) {\n\t\t\t\tthrow new LSHException(\"Bad characters in one or more proposed \" + type);\n\t\t\t}\n\t\t\tif (!names.add(name)) {\n\t\t\t\tthrow new LSHException(\"Duplicate \" + type + \" entry specified: \" + name);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Entry point for the InstallCategoryRequest command\n\t * @param query the query to execute\n\t * @throws LSHException if the category is invalid or already exists\n\t * @throws SQLException if there is an error issuing the query\n\t */\n\tprivate void fdbInstallCategory(InstallCategoryRequest query)\n\t\t\tthrows LSHException, SQLException {\n\t\tResponseInfo response = query.installresponse;\n\t\tif (!CategoryRecord.enforceTypeCharacters(query.type_name)) {\n\t\t\tthrow new LSHException(\"Bad characters in proposed category type\");","sourceCodeStart":2149,"sourceCodeEnd":2185,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java#L2149-L2185","documentation":"Thrown by checkStrings when any string in the provided list fails CategoryRecord.enforceTypeCharacters, which only allows letters, digits, space, '.', '_', ':', '/', '(', ')'. Null, empty, or strings with other characters (e.g., quotes, hyphens, '@', shell metacharacters) are rejected to keep category/tag names safe for SQL column names and XML.","triggerScenarios":"Passing function tag or category names containing disallowed characters (dashes, asterisks, angle brackets, etc.) or null/empty strings in query.info.functionTags or query.info.execats during database creation or category installation.","commonSituations":"Importing tag names from external tooling that uses hyphens or special punctuation; user-supplied category names without sanitization; copy-pasting names with smart quotes or non-ASCII.","solutions":["Sanitize each name through a whitelist filter matching enforceTypeCharacters (alnum plus space . _ : / ( ) ) before submission.","Replace disallowed characters (e.g., '-' to '_') in automated imports.","Validate names client-side and reject invalid input before building the query."],"exampleFix":"// before\nquery.info.functionTags = Arrays.asList(\"my-tag\", \"@special\");\n// after\nstatic boolean validName(String s) {\n    return CategoryRecord.enforceTypeCharacters(s);\n}\nquery.info.functionTags = rawTags.stream()\n    .filter(CategoryRecord::enforceTypeCharacters)\n    .collect(Collectors.toList());","handlingStrategy":"validation","validationCode":"for (String name : list) {\n    if (!CategoryRecord.enforceTypeCharacters(name)) {\n        throw new IllegalArgumentException(\"Invalid characters in: \" + name);\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run CategoryRecord.enforceTypeCharacters on every user-supplied name before building any BSim query.","Constrain input fields to the allowed character set at the UI/API boundary.","Avoid hyphens in tag names — use underscores instead."],"tags":["bsim","validation","input-sanitization"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}