{"record":{"id":"1557ae7ea64a38f7","repo":"t8y2/dbx","slug":"negative-length-d","errorCode":null,"errorMessage":"negative length %d","messagePattern":"negative length (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":804,"sourceCode":"\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif length < 0 {\n\t\treturn nil, fmt.Errorf(\"negative length %d\", length)\n\t}\n\tif length > 64*1024*1024 {\n\t\treturn nil, fmt.Errorf(\"length %d exceeds limit\", length)\n\t}\n\tvalue := make([]byte, int(length))\n\tbyteReader, ok := reader.(io.Reader)\n\tif !ok {\n\t\treturn nil, errors.New(\"reader cannot read token payload\")\n\t}\n\tif _, err := io.ReadFull(byteReader, value); err != nil {\n\t\treturn nil, err\n\t}\n\treturn value, nil\n}\n\nfunc readHadoopVInt(reader io.ByteReader) (int64, error) {\n\tfirstByte, err := reader.ReadByte()\n\tif err != nil {","sourceCodeStart":786,"sourceCodeEnd":822,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L786-L822","documentation":"This error is returned by the Hadoop delegation token byte-array reader when a field's VInt length prefix decodes to a negative number. A negative length is invalid in the token wire format and indicates the token bytes are corrupt or the parser is misaligned. It propagates up wrapped by the identifier/password/kind/service field errors.","triggerScenarios":"Decoding a delegation token whose bytes contain a VInt length that decodes negative — typically random/corrupt bytes or reading a non-token blob as a token.","commonSituations":"Passing an arbitrary password or random string as a delegationToken; token bytes bit-flipped by an encoding conversion (e.g. UTF-16); decoding a foreign token format.","solutions":["Verify the delegationToken value is the actual base64 Hadoop token issued by the server","Regenerate the token from the Hive server","Do not pass passwords or other credentials in the delegationToken field","Check that no encoding conversion altered the token bytes"],"exampleFix":"// before\ncfg.DelegationToken = cfg.Password // wrong credential type\n// after\ncfg.DelegationToken = issuedDelegationToken","handlingStrategy":"validation","validationCode":"func isPlausibleHadoopToken(token string) bool {\n\tdecoded, err := base64.StdEncoding.DecodeString(token)\n\tif err != nil || len(decoded) < 16 { return false }\n\t// first VInt should be a small positive length for the identifier\n\tfirst := int(decoded[0])\n\treturn first > 0 && first < len(decoded)\n}","typeGuard":"func looksLikeHadoopToken(v interface{}) bool {\n\ts, ok := v.(string)\n\tif !ok { return false }\n\treturn isPlausibleHadoopToken(s)\n}","tryCatchPattern":"if err := applyToken(cfg, token); err != nil && strings.Contains(err.Error(), \"negative length\") {\n\treturn fmt.Errorf(\"delegationToken is not a Hadoop token — check credential type: %w\", err)\n}","preventionTips":["Never substitute passwords, JWTs, or API keys into the delegationToken field","Validate the first length byte is a small positive number before use","Type-check credential sources in your config loader"],"tags":["hive","authentication","delegation-token","parsing"],"backgroundTag":"invalid-delegation-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}