owasp-amass/amass · error

exceeded maximum mask size (3): %s

Error message

exceeded maximum mask size (3): %s

What it means

ExpandMask expands hashcat-style masks (e.g. ?l?d) into candidate words, and this library caps a mask at 3 placeholders to bound expansion size. If the input word contains more than three '?' characters, expansion is refused. It protects against combinatorial blowup and accidental '?' usage.

Source

Thrown at config/wordlist.go:33

	"path/filepath"
	"strings"

	"github.com/caffix/stringset"
)

const (
	maskLetters = "abcdefghijklmnopqrstuvwxyz"
	maskDigits  = "0123456789"
	maskSpecial = "-"
)

// ExpandMask will return a slice of words that a "hashcat-style" mask matches.
func ExpandMask(word string) ([]string, error) {
	var expanded []string
	var chars string

	if strings.Count(word, "?") > 3 {
		return expanded, fmt.Errorf("exceeded maximum mask size (3): %s", word)
	}

	parts := strings.SplitN(word, "?", 2)
	if len(parts) > 1 {
		if len(parts[1]) > 0 {
			switch parts[1][0] {
			case 'a':
				chars = maskLetters + maskDigits + maskSpecial
			case 'd':
				chars = maskDigits
			case 'u':
				fallthrough
			case 'l':
				chars = maskLetters
			case 's':
				chars = maskSpecial
			default:
				return expanded, fmt.Errorf("improper mask used: %s", word)

View on GitHub (pinned to 79299dce87)

Solutions

1. Reduce the mask to at most 3 placeholders (e.g. ?l?l?d instead of ?l?l?l?d)
2. Pre-process input words to strip or escape literal '?' characters
3. Expand in multiple passes if more placeholders are genuinely needed

Example fix

// before
words, err := ExpandMask("?l?l?l?d")
// after
words, err := ExpandMask("?l?l?d")

if strings.Count(mask, "?") > 3 { return errors.New("mask has more than 3 placeholders") }

func isValidMask(w string) bool { return strings.Count(w, "?") <= 3 }

words, err := ExpandMask(m)
if err != nil {
  if strings.HasPrefix(err.Error(), "exceeded maximum mask size") {
    // reduce mask or expand in multiple passes
  }
  return err
}

When it happens

Trigger: Calling ExpandMask, ExpandMaskWordlist, or TestExpandMask with a string containing 4+ '?' characters, or a plain word that legitimately contains question marks (e.g. a URL fragment).

Common situations: Feeding dictionary words containing '?' into mask expansion; misremembering the mask limit; recursive expansion producing words that re-enter ExpandMask.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• improper mask used: %s
• the file is empty
• too many items in bulk request
• failed to get absolute path for wordlist file: %w
• unable to load the file in the bruteforce wordlist_file sett

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/73386deba7397f35. Report an issue: GitHub.