golang/go · error

leading hyphen

Error message

leading hyphen

What it means

validateRepoSubDir rejects subdirs beginning with `-`. This is a security guard: a leading hyphen could be interpreted as a command-line flag by the underlying VCS tool, enabling flag-injection.

Source

Thrown at src/cmd/go/internal/vcs/vcs.go:1095

		SubDir:   mmi.SubDir,
		IsCustom: true,
		VCS:      vcs,
	}
	return rr, nil
}

// validateRepoSubDir returns an error if subdir is not a valid subdirectory path.
// We consider a subdirectory path to be valid as long as it doesn't have a leading
// slash (/) or hyphen (-).
func validateRepoSubDir(subdir string) error {
	if subdir == "" {
		return nil
	}
	if subdir[0] == '/' {
		return errors.New("leading slash")
	}
	if subdir[0] == '-' {
		return errors.New("leading hyphen")
	}
	return nil
}

// validateRepoRoot returns an error if repoRoot does not seem to be
// a valid URL with scheme.
func validateRepoRoot(repoRoot string) error {
	url, err := urlpkg.Parse(repoRoot)
	if err != nil {
		return err
	}
	if url.Scheme == "" {
		return errors.New("no scheme")
	}
	if url.Scheme == "file" {
		return errors.New("file scheme disallowed")
	}
	return nil

View on GitHub (pinned to b6b368adc5)

Solutions

1. Fix the subdir so it does not start with a hyphen.
2. Audit the vanity server / meta tags if untrusted.

Example fix

<!-- before -->
<meta name="go-import" content="example.com -flag git+ssh://...">
<!-- after -->
<meta name="go-import" content="example.com pkg git+ssh://...">

// Reject subdirs that could inject flags.
func safeSubdir(s string) error {
    if strings.HasPrefix(s, "-") { return errors.New("subdir must not start with a hyphen") }
    return nil
}

null

null

When it happens

Trigger: A meta tag or import path supplies a subdir starting with `-`, e.g. `-something`.

Common situations: Malicious or malformed vanity meta tags crafted to inject flags.

Related errors

• import path does not begin with hostname
• leading slash
• no scheme
• file scheme disallowed
• value is neither 'auto' nor a valid bool

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/9ec8db341a020c50. Report an issue: GitHub.