What causes "invalid plugin name" in flipped-aurora/gin-vue-admin?

Rename the plugin to match ^[a-z][a-z0-9_]*$: lowercase letters/digits/underscores, starting with a letter (e.g. 'myplugin' or 'my_plugin').

flipped-aurora/gin-vue-admin · error

invalid plugin name

Error message

invalid plugin name

What it means

ValidatePluginName enforces that plugin names are lowercase ASCII Go identifiers (regex ^[a-z][a-z0-9_]*$) and not Go keywords. Names failing either check return 'invalid plugin name'; this guards against path traversal and code-injection when a name is used in paths or generated Go code.

Source

Thrown at server/utils/plugin_security.go:16

package utils

import (
	"errors"
	"go/token"
	"path/filepath"
	"regexp"
	"strings"
)

var pluginNamePattern = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)

// ValidatePluginName restricts plugin names to lowercase ASCII Go identifiers.
func ValidatePluginName(name string) error {
	if !pluginNamePattern.MatchString(name) || token.IsKeyword(name) {
		return errors.New("invalid plugin name")
	}
	return nil
}

// JoinWithinRoot joins path elements while ensuring the result stays below root.
func JoinWithinRoot(root string, elems ...string) (string, error) {
	if strings.TrimSpace(root) == "" {
		return "", errors.New("path root is empty")
	}
	rootAbs, err := filepath.Abs(root)
	if err != nil {
		return "", errors.New("failed to resolve path root")
	}
	for _, elem := range elems {
		if filepath.IsAbs(elem) || filepath.VolumeName(elem) != "" || strings.HasPrefix(elem, "/") || strings.HasPrefix(elem, `\`) {
			return "", errors.New("path escapes root")
		}
	}

View on GitHub (pinned to 3136500ef3)

Solutions

Rename the plugin to match ^[a-z][a-z0-9_]*$: lowercase letters/digits/underscores, starting with a letter (e.g. 'myplugin' or 'my_plugin').
Avoid Go keywords as names ('type', 'range', 'func', etc.).
Sanitize/trim user input before validating (strip spaces, convert to lowercase) in the calling tool.

Example fix

// before
err := utils.ValidatePluginName("my-plugin") // invalid plugin name
// after
err := utils.ValidatePluginName("my_plugin") // nil

Defensive patterns

Strategy: validation

Validate before calling

var pluginNamePattern = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)
func isValidPluginName(s string) bool {
    return pluginNamePattern.MatchString(s) && !token.IsKeyword(s)
}
if !isValidPluginName(name) {
    return fmt.Errorf("plugin name must match ^[a-z][a-z0-9_]*$ and not be a Go keyword")
}

Try / catch

if err := utils.ValidatePluginName(name); err != nil {
    return nil, fmt.Errorf("%q is not a valid plugin name: use lowercase letters, digits and underscores, starting with a letter", name)
}

Prevention

Normalize user input (lowercase, replace '-' with '_', trim) before validation
Document the naming rule wherever plugin names are entered
Never bypass ValidatePluginName to accept hyphenated or path-like names — it is a security control

When it happens

Trigger: Passing names with uppercase letters, leading digits, hyphens, slashes/dots ('../evil', 'my-plugin', '1foo', 'Foo', 'type'), or a Go keyword like 'func'/'range' to ValidatePluginName (e.g. during plugin creation/generation tooling).

Common situations: Users typing plugin names in kebab-case ('my-plugin') per web convention; clipboard input carrying spaces or path separators; attempts to inject traversal sequences — intentionally rejected by this security check.

Related errors

AI-assisted analysis of flipped-aurora/gin-vue-admin@3136500ef3 (2026-08-31). Data as JSON: /api/errors/8098c2afdadca44b. Report an issue: GitHub.