{"id":"3dacc797852aa0a4","repo":"gin-gonic/gin","slug":"invalid-escape-string-in-path-path","errorCode":null,"errorMessage":"invalid escape string in path '${path}'","messagePattern":"invalid escape string in path '(.+?)'","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tree.go","lineNumber":262,"sourceCode":"\t\t}\n\t\tn.handlers = handlers\n\t\tn.fullPath = fullPath\n\t\treturn\n\t}\n}\n\n// Search for a wildcard segment and check the name for invalid characters.\n// Returns -1 as index, if no wildcard was found.\nfunc findWildcard(path string) (wildcard string, i int, valid bool) {\n\t// Find start\n\tescapeColon := false\n\tfor start, c := range []byte(path) {\n\t\tif escapeColon {\n\t\t\tescapeColon = false\n\t\t\tif c == ':' {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tpanic(\"invalid escape string in path '\" + path + \"'\")\n\t\t}\n\t\tif c == '\\\\' {\n\t\t\tescapeColon = true\n\t\t\tcontinue\n\t\t}\n\t\t// A wildcard starts with ':' (param) or '*' (catch-all)\n\t\tif c != ':' && c != '*' {\n\t\t\tcontinue\n\t\t}\n\n\t\t// Find end and check for invalid characters\n\t\tvalid = true\n\t\tfor end, c := range []byte(path[start+1:]) {\n\t\t\tswitch c {\n\t\t\tcase '/':\n\t\t\t\treturn path[start : start+1+end], start, valid\n\t\t\tcase ':', '*':\n\t\t\t\tvalid = false","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/gin-gonic/gin/blob/34dac209ffb6ef85cc78c5d217bbb7ad001d68fd/tree.go#L244-L280","documentation":"Thrown by findWildcard in tree.go:262 when a backslash in a route path is followed by any character other than ':'. Gin uses '\\:' as an escape sequence to literally match a colon in a static path segment; any other escape (e.g. '\\\\', '\\n', '\\/' ) is invalid and the function panics during addRoute. The offending full path is included in the message.","triggerScenarios":"Registering a path that contains a literal backslash for any reason other than escaping a colon, e.g. router.GET(\"/users\\\\:id\", h) with a stray slash, or feeding a Windows-style path like \"C:\\\\dir\" into a route. Also triggered by string concatenation that introduces a '\\n' or '\\t' into the route literal.","commonSituations":"Copy-pasting a regex or Windows file path into a route definition; using fmt.Sprintf to build paths and accidentally embedding a backslash; misunderstanding the '\\:' escape feature and trying to escape slashes or other characters.","solutions":["Remove every backslash from the path that is not part of an intentional '\\:' escape.","If you need a literal colon in a static segment, use the documented escape: router.GET(\"/users\\\\:id\", h) matches the literal text '/users:id'.","Build paths with path.Join or constants rather than string concatenation to avoid stray escape characters.","Lint route strings in a test: assert none contain '\\\\' except in the form '\\\\:'."],"exampleFix":"// before — stray backslash before a non-colon\nrouter.GET(\"/files\\\\/static\", h) // panics: '\\\\/' is not a valid escape\n\n// after — plain slash, no escape needed\nrouter.GET(\"/files/static\", h)\n\n// (the only valid escape is for a literal colon)\nrouter.GET(\"/tag\\\\:literal\", h) // OK, matches '/tag:literal'","handlingStrategy":"validation","validationCode":"// Reject routes containing invalid backslash escapes before registering.\nvar invalidEscape = regexp.MustCompile(`\\\\[^:]`)\n\nfunc validatePath(p string) error {\n    if invalidEscape.MatchString(p) {\n        return fmt.Errorf(\"path %q contains an invalid backslash escape (only '\\\\:' is allowed)\", p)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"func safeRegister(e *gin.Engine, method, path string, h gin.HandlerFunc) (err error) {\n    defer func() {\n        if r := recover(); r != nil {\n            err = fmt.Errorf(\"invalid path %s: %v\", path, r)\n        }\n    }()\n    e.Handle(method, path, h)\n    return nil\n}","preventionTips":["Avoid building route strings with fmt.Sprintf or concatenation; use string constants.","Never embed Windows file paths or regexes into route definitions.","Remember the only valid escape in a Gin path is '\\\\:' for a literal colon.","Add a lint test that scans every registered path for stray backslashes."],"tags":["routing","invalid-path","escape","gin","startup-panic"],"analyzedSha":"34dac209ffb6ef85cc78c5d217bbb7ad001d68fd","analyzedAt":"2026-08-04T21:26:18.438Z","schemaVersion":2}