yudai/gotty · error

failed to parse arguments

Error message

failed to parse arguments

What it means

Wrapped url.Parse error in processWSConn: the query string built from the client-supplied Arguments field (when PermitArguments is on) is not a parseable URL query string, e.g. it contains malformed percent-encoding or stray characters. The attacker-controlled init.Arguments is the input at fault.

Source

Thrown at server/handlers.go:115

	}

	var init InitMessage
	err = json.Unmarshal(initLine, &init)
	if err != nil {
		return errors.Wrapf(err, "failed to authenticate websocket connection")
	}
	if init.AuthToken != server.options.Credential {
		return errors.New("failed to authenticate websocket connection")
	}

	queryPath := "?"
	if server.options.PermitArguments && init.Arguments != "" {
		queryPath = init.Arguments
	}

	query, err := url.Parse(queryPath)
	if err != nil {
		return errors.Wrapf(err, "failed to parse arguments")
	}
	params := query.Query()
	var slave Slave
	slave, err = server.factory.New(params)
	if err != nil {
		return errors.Wrapf(err, "failed to create backend")
	}
	defer slave.Close()

	titleVars := server.titleVariables(
		[]string{"server", "master", "slave"},
		map[string]map[string]interface{}{
			"server": server.options.TitleVariables,
			"master": map[string]interface{}{
				"remote_addr": conn.RemoteAddr(),
			},
			"slave": slave.WindowTitleVariables(),
		},

View on GitHub (pinned to a080c85cbc)

Solutions

1. Reject or URL-sanitize init.Arguments before parsing instead of passing it through
2. Run with PermitArguments disabled unless clients are trusted
3. Return a 4xx-style close to the master so the client sees the arguments were invalid

When it happens

Trigger: Thrown at server/handlers.go:115 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of yudai/gotty@a080c85cbc (2026-09-02). Data as JSON: /api/errors/0436c2ae957641a0. Report an issue: GitHub.