{"record":{"id":"1f82157e91cf3cc3","repo":"elastic/elasticsearch","slug":"permissions-out-of-range","errorCode":null,"errorMessage":"permissions [{}] out of range","messagePattern":"permissions \\[(.+?)\\] out of range","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"build-tools/src/main/java/org/elasticsearch/gradle/util/PermissionUtils.java","lineNumber":38,"sourceCode":"public class PermissionUtils {\n\n    public static void chmod(Path path, int mode) throws IOException {\n        final PosixFileAttributeView view = Files.getFileAttributeView(path, PosixFileAttributeView.class);\n        if (view != null && (mode != 0)) {\n            final Set<PosixFilePermission> permissions = permissionsFromInt(mode);\n            Files.setPosixFilePermissions(path, permissions);\n        }\n    }\n\n    private static Set<PosixFilePermission> permissionsFromInt(int mode) {\n        return PosixFilePermissions.fromString(\n            permissions((mode >> 6) & 07) + permissions((mode >> 3) & 07) + permissions((mode >> 0) & 07)\n        );\n    }\n\n    private static String permissions(final int permissions) {\n        if (permissions < 0 || permissions > 7) {\n            throw new IllegalArgumentException(\"permissions [\" + permissions + \"] out of range\");\n        }\n        final StringBuilder sb = new StringBuilder(3);\n        if ((permissions & 4) == 4) {\n            sb.append('r');\n        } else {\n            sb.append('-');\n        }\n        if ((permissions & 2) == 2) {\n            sb.append('w');\n        } else {\n            sb.append('-');\n        }\n        if ((permissions & 1) == 1) {\n            sb.append('x');\n        } else {\n            sb.append('-');\n        }\n        return sb.toString();","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/build-tools/src/main/java/org/elasticsearch/gradle/util/PermissionUtils.java#L20-L56","documentation":"Thrown by PermissionUtils.permissions(int) when a single POSIX permission octet is outside 0..7. The method builds the rwx string for one 3-bit group. permissionsFromInt masks each group with & 07, so through that path the value is provably 0..7 and this guard is effectively unreachable; it is a defensive assertion against direct or future misuse.","triggerScenarios":"A direct call to the private permissions(int) with a value < 0 or > 7, or a future refactor that feeds an unmasked integer. Via permissionsFromInt(mode) the mask guarantees 0..7 and the exception cannot fire.","commonSituations":"Effectively only reachable through reflection or an incorrect refactor that bypasses the & 07 mask; not a normal user-facing error.","solutions":["Mask the input with & 07 before passing it in.","Validate the source mode is a valid POSIX octal (e.g. 0644, 0755) before conversion.","Keep the permissionsFromInt indirection so the mask is always applied."],"exampleFix":"// before\npermissions(rawMode);\n// after\npermissions(rawMode & 07);","handlingStrategy":"validation","validationCode":"if (perm < 0 || perm > 7) {\n    throw new IllegalArgumentException(\"permissions [\" + perm + \"] out of range\");\n}\n// safe to convert\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always mask octal permission groups with & 07 before converting.","Validate external mode inputs (e.g. from config) against the 0..0777 range before conversion.","Keep the permissionsFromInt indirection so the mask is always applied."],"tags":["posix","permissions","defensive","build-tools"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}