siyuan-note/siyuan · error

path contains invalid character [%s]

Error message

path contains invalid character [%s]

What it means

Returned by validateExclusionPath when the install path or workspace directory contains a character from the set & | < > ^ % ! " ' $ ` — these are cmd.exe and PowerShell metacharacters. The guard prevents command injection through the user-controlled workspace path when it's passed (via ShellExecute 'runas') to the elevated elevator process that runs Defender exclusion commands.

Source

Thrown at kernel/model/elevator_windows.go:136

	util.PushMsg(Conf.language(252), 0)
}

func isUsingMicrosoftDefender() bool {
	if !gulu.OS.IsWindows() {
		return false
	}

	cmd := exec.Command("powershell", "-Command", "Get-MpPreference")
	gulu.CmdAttr(cmd)
	return cmd.Run() == nil
}

// validateExclusionPath 校验用于添加到 Windows Defender 排除项的路径，
// 拒绝包含 cmd.exe 或 PowerShell 元字符的路径，防止通过未转义的路径字符串实现命令注入
func validateExclusionPath(path string) error {
	for _, c := range path {
		if strings.ContainsRune("&|<>^%!\"'$`", c) {
			return fmt.Errorf("path contains invalid character [%s]", string(c))
		}
	}
	return nil
}

func getElevatorBin() string {
	elevator := filepath.Join(util.WorkingDir, "kernel", "elevator.exe")
	if "dev" == util.Mode || !gulu.File.IsExist(elevator) {
		elevator = filepath.Join(util.WorkingDir, "elevator", "elevator-"+runtime.GOARCH+".exe")
	}
	return elevator
}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Move the SiYuan workspace to a directory whose path contains no shell metacharacters (& | < > ^ % ! " ' $ `).
2. If the install path itself is the problem, reinstall SiYuan to a path without special characters.
3. If you cannot move the workspace, you can manually add the exclusion in Windows Defender settings (Settings > Update & Security > Windows Security > Virus & threat protection > Exclusions).

// Pre-validate workspace path before kernel boot
func hasShellMetachar(p string) bool {
    return strings.ContainsAny(p, "&|<>^%!\"'$`")
}
if hasShellMetachar(util.WorkspaceDir) {
    return errors.New("workspace path must not contain shell metacharacters")
}

if err := model.AddMicrosoftDefenderExclusion(); err != nil {
    if strings.Contains(err.Error(), "invalid character") {
        // path has metacharacters — move workspace or add exclusion manually
        logging.LogWarnf("workspace path rejected by Defender exclusion guard: %v", err)
    }
}

When it happens

Trigger: AddMicrosoftDefenderExclusion calls validateExclusionPath on both the install path and util.WorkspaceDir. If the user chose a workspace directory containing any metacharacter (e.g., a path with an ampersand or dollar sign), validation fails and Defender exclusion is skipped.

Common situations: User set the SiYuan workspace to a path like C:\Users\Me & You\Notes or D:\Data$\SiYuan. Less commonly, the install path itself contains a special character (e.g., installed under C:\Program Files (x86)\... — parentheses are fine, but & or % in a custom install path would trigger it).

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• not found elevator [%s]
• asset path must be under assets
• encrypted notebook is locked, please unlock it first
• refuse to write decrypted asset inside workspace
• source is not an encrypted asset

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/9106e77d78272f22. Report an issue: GitHub.