louislam/uptime-kuma · warning · Error

Invalid language

Error message

Invalid language

What it means

Thrown by the getPushExample handler when the language argument fails the regex ^[a-z-]+$. The handler uses language to build a directory path ./extra/push-examples/<language>, so the whitelist prevents path traversal and rejects anything outside the available example languages.

Source

Thrown at server/socket-handlers/general-socket-handler.js:120

                .catch((e) => {
                    callback({
                        ok: false,
                        msg: e.message,
                    });
                });
        } catch (e) {
            callback({
                ok: false,
                msg: e.message,
            });
        }
    });

    socket.on("getPushExample", async (language, callback) => {
        try {
            checkLogin(socket);
            if (!/^[a-z-]+$/.test(language)) {
                throw new Error("Invalid language");
            }
        } catch (e) {
            callback({
                ok: false,
                msg: e.message,
            });
            return;
        }

        try {
            let dir = path.join("./extra/push-examples", language);
            let files = await fsAsync.readdir(dir);

            for (let file of files) {
                if (file.startsWith("index.")) {
                    callback({
                        ok: true,
                        code: await fsAsync.readFile(path.join(dir, file), "utf8"),

View on GitHub (pinned to 6b5ea01557)

Solutions

1. Pass one of the language directory names that exist under extra/push-examples (e.g. 'nodejs', 'bash', 'python') using lowercase ASCII letters and hyphens only.
2. Sanitize any user-supplied language input on the client against the allowed list before emitting.
3. Reject language values containing digits, dots, slashes, or uppercase before sending.

Example fix

// before
socket.emit("getPushExample", "en_US", cb);
// after
socket.emit("getPushExample", "nodejs", cb);

const ALLOWED = fs.readdirSync("./extra/push-examples"); // or hard-coded list
if (!/^[a-z-]+$/.test(language) || !ALLOWED.includes(language)) {
  throw new Error("Invalid language");
}
socket.emit("getPushExample", language, cb);

function isSafeLanguage(l) {
  return typeof l === "string" && /^[a-z-]+$/.test(l);
}

try { await emitAsync("getPushExample", lang, cb); }
catch (e) { if (e.message === "Invalid language") showLanguageError(); else throw e; }

When it happens

Trigger: Client emits 'getPushExample' with a language containing digits, uppercase letters, slashes, dots, or any non [a-z-] character; an attacker probes the endpoint to escape the push-examples directory.

Common situations: Frontend sends a language code with a region suffix in the wrong format (e.g. 'en_US', 'EN', 'c++'); attempted directory traversal ('../etc'); user-typed language code from a URL parameter.

Related errors

• Invalid service name. Only alphanumeric characters and '.',
• You do not own this monitor.
• Invalid period.
• Permission denied.
• Maintenance not found

AI-assisted analysis of louislam/uptime-kuma@6b5ea01557 (2026-08-12). Data as JSON: /api/errors/046c2b5098b0b3f3. Report an issue: GitHub.