apache/hadoop · error · RuntimeException

Non-alphanumeric data found in input, aborting.

Error message

Non-alphanumeric data found in input, aborting.

What it means

ProfileOutputServlet (the async-profiler endpoint's output reader) validates the requested output file name with a strict whitelist regex [a-zA-Z0-9%=&.\-]* before serving. Anything outside that set - slashes, spaces, colons, underscores are not even allowed - triggers RuntimeException('Non-alphanumeric data found in input, aborting.'). The check exists to block path traversal and XSS/HTML injection through the servlet's parameters.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/ProfileOutputServlet.java:85

      if (req.getQueryString() != null) {
        refreshUrl += "?" + sanitize(req.getQueryString());
      }
      ProfileServlet.setResponseHeader(resp);
      resp.setHeader("Refresh", REFRESH_PERIOD + ";" + refreshUrl);
      resp.getWriter().write("This page will be auto-refreshed every " + REFRESH_PERIOD
          + " seconds until the output file is ready. Redirecting to " + refreshUrl);
    } else {
      super.doGet(req, resp);
    }
  }

  static String sanitize(String input) {
    // Basic test to try to avoid any XSS attacks or HTML content showing up.
    // Duplicates HtmlQuoting a little, but avoid destroying ampersand.
    if (ALPHA_NUMERIC.matcher(input).matches()) {
      return input;
    }
    throw new RuntimeException("Non-alphanumeric data found in input, aborting.");
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Pass a bare file name built only from letters, digits, '%', '=', '&', '.', and '-' (e.g. name=flame.html)
2. Strip path components and disallowed characters on the client before issuing the request
3. Treat the RuntimeException (HTTP 500) as a 400-class input error and fix the caller, not the server

Example fix

# before
GET /prof-output?name=logs/flame.html

# after
GET /prof-output?name=flame.html

private static final Pattern OK = Pattern.compile("[a-zA-Z0-9%=&.\\-]*");
String safeName(String requested) {
  String base = requested.substring(requested.lastIndexOf('/') + 1);
  if (!OK.matcher(base).matches()) {
    throw new IllegalArgumentException("profiler output name has disallowed characters");
  }
  return base;
}

try {
  fetchProfilerOutput(name);
} catch (RuntimeException e) {
  if (e.getMessage().contains("Non-alphanumeric")) {
    // bad request: report 400 to the caller with allowed-character guidance
  }
}

When it happens

Trigger: Requesting the async-profiler output with a name parameter containing '/', '\', ':', '_', or spaces, e.g. /prof-output?name=logs/flame.html or name=my_profile.html; URL-encoding tricks that decode to other characters.

Common situations: Profiler UI scripts or curl commands carrying a path-qualified file name; copy-pasted profiler commands from other tools that use underscores in default file names.

Related errors

• Unsupported compression algorithm name:
• Null user
• owner == null && group == null
• Path must be absolute: " + path
• Append is not supported by BaiduBosFileSystem

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/00edbbd1274d1e7e. Report an issue: GitHub.