{"id":"c610f430788a64bd","repo":"go-sql-driver/mysql","slug":"invalid-value-for-server-pub-key-name-v","errorCode":null,"errorMessage":"invalid value for server pub key name: %v","messagePattern":"invalid value for server pub key name: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"dsn.go","lineNumber":632,"sourceCode":"\t\tcase \"readTimeout\":\n\t\t\tcfg.ReadTimeout, err = time.ParseDuration(value)\n\t\t\tif err != nil {\n\t\t\t\treturn\n\t\t\t}\n\n\t\t// Reject read-only connections\n\t\tcase \"rejectReadOnly\":\n\t\t\tvar isBool bool\n\t\t\tcfg.RejectReadOnly, isBool = readBool(value)\n\t\t\tif !isBool {\n\t\t\t\treturn errors.New(\"invalid bool value: \" + value)\n\t\t\t}\n\n\t\t// Server public key\n\t\tcase \"serverPubKey\":\n\t\t\tname, err := url.QueryUnescape(value)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid value for server pub key name: %v\", err)\n\t\t\t}\n\t\t\tcfg.ServerPubKey = name\n\n\t\t// Strict mode\n\t\tcase \"strict\":\n\t\t\tpanic(\"strict mode has been removed. See https://github.com/go-sql-driver/mysql/wiki/strict-mode\")\n\n\t\t// Dial Timeout\n\t\tcase \"timeout\":\n\t\t\tcfg.Timeout, err = time.ParseDuration(value)\n\t\t\tif err != nil {\n\t\t\t\treturn\n\t\t\t}\n\n\t\t// TLS-Encryption\n\t\tcase \"tls\":\n\t\t\tboolValue, isBool := readBool(value)\n\t\t\tif isBool {","sourceCodeStart":614,"sourceCodeEnd":650,"githubUrl":"https://github.com/go-sql-driver/mysql/blob/c426bd93799de0f0e094c8f0582872c529d0ed0a/dsn.go#L614-L650","documentation":"Returned when the `serverPubKey` DSN parameter fails URL-unescaping. serverPubKey references a name previously registered with mysql.RegisterServerPubKey, used during sha256_password / caching_sha2_password RSA exchange. The driver runs url.QueryUnescape on the value at dsn.go:632 and surfaces the unescape error if the value contains malformed percent-encoding.","triggerScenarios":"DSN contains `serverPubKey=<value>` where value has a bad percent sequence such as `%` not followed by two hex digits (e.g. `serverPubKey=key%2`, `serverPubKey=100%done`). The unescape at dsn.go:630 returns an error which is wrapped and returned at dsn.go:632.","commonSituations":"Embedding a name containing a literal `%` character without encoding it; constructing the DSN via string concatenation instead of using the Config.FormatDSN builder; copy-paste from a URL where the value was already partly encoded.","solutions":["URL-encode the value when building the DSN: `serverPubKey=` + url.QueryEscape(name).","Use plain ASCII alphanumeric names for registered public keys so no escaping is needed.","Build the DSN from a Config struct via cfg.FormatDSN() instead of hand-concatenating strings."],"exampleFix":"// before\nname := \"my%key\"\ndsn := fmt.Sprintf(\"u:p@/db?serverPubKey=%s\", name)\n// after\nname := \"my%key\"\ndsn := fmt.Sprintf(\"u:p@/db?serverPubKey=%s\", url.QueryEscape(name))","handlingStrategy":"validation","validationCode":"if _, err := url.QueryUnescape(serverPubKeyRaw); err != nil {\n    return fmt.Errorf(\"serverPubKey is not URL-safe: %w\", err)\n}\ndsn += \"&serverPubKey=\" + url.QueryEscape(name)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always url.QueryEscape values injected into a DSN.","Prefer Config.FormatDSN over string concatenation.","Keep registered pub key names to plain ASCII."],"tags":["config","dsn","tls","encoding"],"analyzedSha":"c426bd93799de0f0e094c8f0582872c529d0ed0a","analyzedAt":"2026-08-04T21:52:59.219Z","schemaVersion":2}