{"record":{"id":"d9e0a7c55e605bd1","repo":"shadow1ng/fscan","slug":"random-string-length-must-be-between-0-and-d","errorCode":null,"errorMessage":"random string length must be between 0 and %d","messagePattern":"random string length must be between 0 and (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"webscan/lib/eval_random.go","lineNumber":119,"sourceCode":"\t\t\t},\n\t\t},\n\t}\n}\n\nfunc randomIntSpan(min, max int64) (int64, error) {\n\tif max <= min {\n\t\treturn 0, fmt.Errorf(\"randomInt: max(%d) must be greater than min(%d)\", max, min)\n\t}\n\tconst maxInt64 = int64(^uint64(0) >> 1)\n\tif min < 0 && max > maxInt64+min {\n\t\treturn 0, fmt.Errorf(\"randomInt: range too large\")\n\t}\n\treturn max - min, nil\n}\n\nfunc validateRandomStringLength(n types.Int) (int, error) {\n\tif n < 0 || n > maxRandomStringLength {\n\t\treturn 0, fmt.Errorf(\"random string length must be between 0 and %d\", maxRandomStringLength)\n\t}\n\treturn int(n), nil\n}\n","sourceCodeStart":101,"sourceCodeEnd":123,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/webscan/lib/eval_random.go#L101-L123","documentation":"validateRandomStringLength bounds the requested length for the randomStr/random string expression function to [0, maxRandomStringLength]. Passing a negative or excessively large length returns this error naming the allowed maximum.","triggerScenarios":"Calling the random-string function with n < 0 or n > maxRandomStringLength, typically via a POC expression like randomStr(999999999).","commonSituations":"POC templates with oversized random payloads for buffer-overflow style tests; negative lengths from computed expressions; copy-pasted templates written for libraries with larger limits.","solutions":["Use a length between 0 and maxRandomStringLength (see the %d in the message).","For larger payloads, build them by concatenating multiple randomStr calls.","Clamp the computed length with a min/max helper before calling the function."],"exampleFix":"// before\ns, err := randomStr(1 << 30) // too large\n\n// after\nn := 1 << 30\nif n > maxRandomStringLength { n = maxRandomStringLength }\ns, err := randomStr(n)","handlingStrategy":"validation","validationCode":"func saneLen(n int) (int, error) {\n    if n < 0 || n > maxRandomStringLength {\n        return 0, fmt.Errorf(\"length %d out of [0,%d]\", n, maxRandomStringLength)\n    }\n    return n, nil\n}","typeGuard":null,"tryCatchPattern":"n, err := validateRandomStringLength(want)\nif err != nil {\n    n = maxRandomStringLength // clamp instead of failing\n}","preventionTips":["Clamp computed lengths before calling random string functions.","Build large payloads by concatenating multiple bounded random strings.","Keep POC template lengths within documented limits."],"tags":["validation","range-check","random","string"],"backgroundTag":"value-out-of-range","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}