{"record":{"id":"ffb1083d8adde355","repo":"alibaba/open-code-review","slug":"s-produced-a-control-byte-0x-02x-at-offset-d-a","errorCode":null,"errorMessage":"%s produced a control byte 0x%02X at offset %d; a credential must not contain control characters","messagePattern":"(.+?) produced a control byte 0x%02X at offset (.+?); a credential must not contain control characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/llm/keycmd.go","lineNumber":124,"sourceCode":"\t// leaves it, TrimSpace below only strips the edges, and a CR inside a credential\n\t// makes net/http reject the Authorization header with an opaque error.\n\ttrimmed := strings.TrimRight(out.buf.String(), \"\\r\\n\")\n\tif strings.ContainsAny(trimmed, \"\\n\\r\") {\n\t\treturn \"\", fmt.Errorf(\"%s produced multi-line output; expected a single credential (pipe through 'head -n1' if your command prints more)\", label)\n\t}\n\t// Same reason as the line-break check, wider net: httpguts.ValidHeaderFieldValue\n\t// (what net/http enforces) rejects every byte below 0x20 except SP and TAB, plus\n\t// DEL. A NUL or VT smuggled in by e.g. `printf 'sk-a\\0b'` would otherwise reach\n\t// net/http as the opaque `invalid header field value for \"Authorization\"`.\n\t//\n\t// Deliberately before the TrimSpace below, so a trailing control byte is an\n\t// error naming its offset rather than silently stripped: only TAB, SP and the\n\t// line breaks already handled above are things a credential command can\n\t// plausibly append by accident. Offsets are therefore into the pre-TrimSpace\n\t// string, which is what the command actually produced.\n\tfor i := 0; i < len(trimmed); i++ {\n\t\tif b := trimmed[i]; (b < 0x20 && b != '\\t') || b == 0x7f {\n\t\t\treturn \"\", fmt.Errorf(\"%s produced a control byte 0x%02X at offset %d; a credential must not contain control characters\", label, b, i)\n\t\t}\n\t}\n\n\tkey := strings.TrimSpace(trimmed)\n\tif key == \"\" {\n\t\treturn \"\", fmt.Errorf(\"%s produced empty output\", label)\n\t}\n\treturn key, nil\n}\n","sourceCodeStart":106,"sourceCodeEnd":134,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/internal/llm/keycmd.go#L106-L134","documentation":"After the line-break check, every byte of the command output is scanned for control characters (bytes < 0x20 except TAB, and DEL 0x7f). A credential containing such a byte would later be rejected by net/http with an opaque header error, so the loader fails early and names the byte and its offset — offsets are into the pre-TrimSpace output, exactly what the command produced.","triggerScenarios":"The credential command emits binary or corrupted data — printf with an escaped NUL, a decrypted blob instead of a token, a truncated binary secret, or ANSI escape sequences (ESC 0x1b) from colored output.","commonSituations":"Base64-decode mistakes leaving binary bytes; colored CLI output with ANSI codes; a mis-decrypted age/gpg payload; corrupted stored secrets.","solutions":["Check the reported offset and hex byte against the raw output (<your-cmd> | xxd | head) to find the corruption source","Remove ANSI coloring from the helper command (NO_COLOR=1 or a --no-color flag)","Fix the decryption/decoding step so the command emits plain ASCII text","Re-create/re-rotate the credential if the stored value itself is corrupted"],"exampleFix":"// before\nkeyCmd: \"credential-decrypt blob.enc\" // emits binary\n// after\nkeyCmd: \"NO_COLOR=1 credential-decrypt --text blob.enc\"","handlingStrategy":"validation","validationCode":"out, _ := exec.Command(\"sh\", \"-c\", \"<your-key-cmd>\").Output()\nfor i, b := range out {\n\tif (b < 0x20 && b != '\\t') || b == 0x7f { /* control byte at offset i; fix source */ }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Disable ANSI color in helper commands (NO_COLOR=1)","Ensure decryption steps emit plaintext, not binary","Validate the stored secret is plain ASCII after rotation"],"tags":["credentials","exec","validation","control-characters"],"backgroundTag":"invalid-credential-characters","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}