{"record":{"id":"05d00f8f5bf23388","repo":"risingwavelabs/risingwave","slug":"adlsgen2-authority-host-must-not-contain-a-query-o","errorCode":null,"errorMessage":"adlsgen2.authority_host must not contain a query or fragment","messagePattern":"adlsgen2\\.authority_host must not contain a query or fragment","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/iceberg/mod.rs","lineNumber":881,"sourceCode":"            // echoed into error messages in case a user pasted a secret by mistake.\n            if let Some(host) = sp_authority {\n                let parsed = Url::parse(host).map_err(|_| {\n                    anyhow!(\n                        \"adlsgen2.authority_host does not parse as a URL ({} chars)\",\n                        host.len()\n                    )\n                })?;\n                if parsed.scheme() != \"https\" {\n                    bail!(\n                        \"adlsgen2.authority_host must use the https scheme, got {}\",\n                        parsed.scheme()\n                    );\n                }\n                if !parsed.username().is_empty() || parsed.password().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain userinfo\");\n                }\n                if parsed.query().is_some() || parsed.fragment().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain a query or fragment\");\n                }\n                if !matches!(parsed.path(), \"\" | \"/\") {\n                    bail!(\"adlsgen2.authority_host must not contain a path component\");\n                }\n            }\n\n            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {\n                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());\n                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());\n                require_rest(\"adlsgen2\")?;\n            }\n\n            if let (Some(tenant_id), Some(client_id), Some(client_secret)) =\n                (sp_tenant, sp_client, sp_secret)\n            {\n                iceberg_configs.insert(ADLS_TENANT_ID.to_owned(), tenant_id.to_owned());\n                iceberg_configs.insert(ADLS_CLIENT_ID.to_owned(), client_id.to_owned());\n                iceberg_configs.insert(ADLS_CLIENT_SECRET.to_owned(), client_secret.to_owned());","sourceCodeStart":863,"sourceCodeEnd":899,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/iceberg/mod.rs#L863-L899","documentation":"adlsgen2.authority_host must be a bare origin: query strings and fragments are rejected because the token endpoint is constructed purely from the origin and path '/', and extra components indicate a malformed or mis-copied URL.","triggerScenarios":"Setting authority_host to values like 'https://login.microsoftonline.com?tenant=x' or 'https://login.microsoftonline.com#orig'.","commonSituations":"Copying a full login URL from a browser address bar including ?redirect_uri=... parameters; sharing links with tracking fragments.","solutions":["Strip everything from '?' and '#' onward, keeping only the bare origin (scheme + host + optional '/').","Use the canonical AAD host, e.g. https://login.microsoftonline.com/.","Remove authority_host to use the built-in default endpoint."],"exampleFix":"// before\n'adlsgen2.authority_host' = 'https://login.microsoftonline.com?tenant=abc'\n// after\n'adlsgen2.authority_host' = 'https://login.microsoftonline.com/'","handlingStrategy":"validation","validationCode":"// strip query/fragment and verify bare origin\nfunction isBareOrigin(v) { try { const u = new URL(v); return u.search === '' && u.hash === ''; } catch { return false; } }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Trim '?' and '#' and everything after from copied URLs.","Keep a canonical constant for the authority host in your infra config.","Never reuse browser address-bar URLs directly in DDL."],"tags":["iceberg","adlsgen2","url","configuration"],"backgroundTag":"invalid-url-format","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}