user service '{}': environment value for {key} contains {c:?

Error message

user service '{}': environment value for {key} contains {c:?}, which cmd.exe would reinterpret; set it inside the program instead

What it means

When environment variables are set via cmd.exe `set` commands, characters like quotes, percent signs, and cmd metacharacters (&, |, <, >, ^) or line breaks would be reinterpreted by cmd.exe rather than stored literally in the value. exec_action rejects any value containing them to avoid command injection or corrupted env values.

Source

Thrown at src/system/scheduled_tasks.rs:216

/// change are rejected rather than passed through differently.
fn exec_action(request: &ScheduledTaskRequest) -> Result<(String, String)> {
    let (program, args) = split_command(&request.command);
    if request.environment.is_empty() {
        return Ok((program, args));
    }
    let mut sets = vec![];
    for (key, value) in &request.environment {
        if key.is_empty() || key.contains(['=', '"', '%', '\n', '\r']) {
            bail!(
                "user service '{}': environment key {key:?} cannot be set through cmd.exe",
                request.name
            );
        }
        if let Some(c) = value
            .chars()
            .find(|c| matches!(c, '"' | '%' | '&' | '|' | '<' | '>' | '^' | '\n' | '\r'))
        {
            bail!(
                "user service '{}': environment value for {key} contains {c:?}, which cmd.exe would reinterpret; set it inside the program instead",
                request.name
            );
        }
        sets.push(format!("set \"{key}={value}\""));
    }
    // the command line goes through cmd.exe too: what it would split or
    // chain is rejected the same way, rather than run differently
    if let Some(c) = format!("{program} {args}")
        .chars()
        .find(|c| matches!(c, '%' | '&' | '|' | '<' | '>' | '^' | '\n' | '\r'))
    {
        bail!(
            "user service '{}': the command contains {c:?}, which cmd.exe would reinterpret when `environment` is set; move it into a script",
            request.name
        );
    }
    let program = if program.contains(char::is_whitespace) {

View on GitHub (pinned to afd2eddd3a)

Solutions

Remove or escape-safe the offending character in the value — set it inside the program itself (config file, internal env setup) instead of through the service definition.
Strip CR/LF when loading values from files or YAML.
Base64-encode values containing metacharacters and decode them in the program.
If the value legitimately needs '%', avoid the cmd.exe env mechanism: drop request.environment and encode the setting in the command or program config.

Example fix

// before
env.insert("CONN".into(), "Server=a&Password=b".into());
// after
env.insert("CONN_FILE".into(), "C:\\svc\\conn.txt".into()); // program reads the value from the file

Defensive patterns

Strategy: validation

Validate before calling

fn valid_env_value(key: &str, value: &str) -> Result<(), String> {
    if let Some(c) = value.chars().find(|c| matches!(c, '"' | '%' | '&' | '|' | '<' | '>' | '^' | '\n' | '\r')) {
        return Err(format!("env value for {key} contains forbidden char {c:?}"));
    }
    Ok(())
}

Prevention

Store secret/complex values in files and pass the file path instead of the raw value
Base64-encode values that must contain metacharacters and decode inside the program
Strip CR/LF from values read from YAML/.env sources
Keep passwords out of env vars set through cmd.exe entirely

When it happens

Trigger: Calling render_xml (via exec_action) for a user service whose request.environment has a value containing any of: '"', '%', '&', '|', '<', '>', '^', '\n', or '\r'.

Common situations: Passwords or connection strings containing '&' or '%'; JSON or regex snippets with quotes; multi-line certificates/keys pasted into an env var; Windows-style '%VAR%' expansion strings; values read from files with trailing CRLF.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/3aaa7d81d7442147. Report an issue: GitHub.