nodejs/node · warning · WebParameterError

Invalid name '%s'

Error message

Invalid name '%s'

What it means

grokdump.py's web server endpoint resolves a requested dump formatter by name. get_dump_formatter() rejects any name that does not match DUMP_FILE_RE (re.compile(r"[-_0-9a-zA-Z][-\._0-9a-zA-Z]*\.dmp$")) by raising WebParameterError. This is a security-oriented validation: names must start with a safe char, contain only [A-Za-z0-9_.-], and end in `.dmp`, blocking path traversal and arbitrary file access.

Source

Thrown at deps/v8/tools/grokdump.py:3707

  def set_dump_desc(self, name, description):
    if not DUMP_FILE_RE.match(name):
      return False
    fname = os.path.join(self.dumppath, name)
    if not os.path.isfile(fname):
      return False
    fname = fname + ".desc"
    descfile = open(fname, "w")
    descfile.write(description)
    descfile.close()
    return True

  def get_dump_formatter(self, name):
    if name is None:
      return self.default_formatter
    else:
      if not DUMP_FILE_RE.match(name):
        raise WebParameterError("Invalid name '%s'" % name)
      formatter = self.formatters.get(name, None)
      if formatter is None:
        try:
          formatter = InspectionWebFormatter(
              self.switches, os.path.join(self.dumppath, name), self)
          self.formatters[name] = formatter
        except IOError:
          raise WebParameterError("Could not open dump '%s'" % name)
      return formatter

  def output_dumps(self, f):
    f.write(WEB_DUMPS_HEADER)
    f.write("<h3>List of available dumps</h3>")
    f.write("<table class=\"dumplist\">\n")
    f.write("<thead><tr>")
    f.write("<th>Name</th>")
    f.write("<th>File time</th>")
    f.write("<th>Comment</th>")

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Ensure the requested name ends in `.dmp` and contains only letters, digits, underscore, hyphen, or dot (e.g. `my-heap.001.dmp`).
2. Do not include directory separators or a leading dot; the server resolves names under a fixed dumppath.
3. If you have a `.heapsnapshot`, first convert/export it to the V8 `.dmp` format the inspector expects.

Example fix

// before
  ?name=heapshot               // 400 Invalid name 'heapshot'
// after
  ?name=heapshot.dmp           // matches DUMP_FILE_RE

import re
DUMP_FILE_RE = re.compile(r"[-_0-9a-zA-Z][-\._0-9a-zA-Z]*\.dmp$")
if not name or not DUMP_FILE_RE.match(name):
    return 'Invalid name; must match [-_0-9a-zA-Z][-\._0-9a-zA-Z]*.dmp', 400

null

null

When it happens

Trigger: An HTTP request to the grokdump web UI supplies a dump `name` query parameter with a bad extension (e.g. `heapdump`, `.heapsnapshot`), disallowed characters (slashes, `..`), or an empty/leading-dot name. The regex test fails and WebParameterError is raised, surfaced as an HTTP 400.

Common situations: User types a dump name without the .dmp suffix in the web form; automated client posts a `.heapsnapshot` filename expecting it to work; attempted path-traversal (`../../etc/passwd`) is correctly blocked here.

Related errors

• Invalid URL: ${url}
• Could not open dump '%s'
• {template}
• `${baseKey}` is not a valid npm option
• The ${key} option is protected, and cannot be retrieved in t

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/bf56ad95d50f1184. Report an issue: GitHub.