Argument types

A full list of argument types are below;

Argument types reference table
Type	Rendered as	Allowed values
(default)	Textbox	If a `type:` is not set, and `choices:` is empty, then ascii will be used, and a warning will be logged. It is recommended that you set the type explicitly, rather than relying on defaults.
ascii	Textbox	a-z (case insensitive), 0-9, but no spaces or punctuation
ascii_identifier	Textbox	Like a DNS name, a-Z (case insensitive), 0-9, `-`, `.`, and `_`.
ascii_sentence	Textbox	a-z (case insensitive), 0-9, with spaces, `.` and `,`.
unicode_identifier	Textbox	Like an ascii identifier, but allows unicode characters. This is useful for languages that use non-ascii characters, such as Chinese, Japanese, etc.
email	Textbox	An email address.
password	Password	A password, which is hidden when typed.
very_dangerous_raw_string	Textbox	Anything. This is incredibly dangerous, as effectively people can type anything they like, including executing additional commands beyond what you specify. Absolutely should not be used unless your OliveTin instance can only be used by people you trust entirely.
regex:…	Textbox	Version 2024.03.081 and above support custom regex patterns. See Custom regex arguments.
int	Textbox	Any number, made up of the characters 0 to 9. Negative numbers are not supported.
url	Textbox	A URL (e.g. https://example.com). Accepts any scheme, including `file://` and `ftp://`. See warning below.
confirmation	Confirmation	A "hidden" argument that makes the action require a confirmation before launching.
n/a, but `choices` used	Dropdown	A "hidden" argument that makes the action require a confirmation before launching.
raw_string_multiline	Textarea	Anything. This is dangerous, as effectively people can type anything they like

Security risk: URL argument type

The url argument type does not restrict the URL scheme. Users can enter file:// (local filesystem) URLs, ftp://, or other schemes. If the argument value is passed directly to curl, wget, or similar tools, a malicious or mistaken input could read local files, access internal services, or trigger unwanted network requests.

If your action might be used by untrusted users, validate or filter the URL in your script (e.g. allow only https://) before using the value.