{"record":{"id":"28abf81223a27cd0","repo":"quarkusio/quarkus","slug":"spiffe-id-path-must-not-contain-dot-segments","errorCode":null,"errorMessage":"SPIFFE ID path must not contain dot segments: ","messagePattern":"SPIFFE ID path must not contain dot segments: ","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":133,"sourceCode":"            }\n        }\n\n        String path = uri.getPath();\n        if (path == null || path.isEmpty() || \"/\".equals(path)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-root path: \" + spiffeId);\n        }\n        if (path.endsWith(\"/\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID path must not have a trailing slash: \" + spiffeId);\n        }\n        String[] segments = path.split(\"/\", -1);\n        for (int i = 1; i < segments.length; i++) {\n            String segment = segments[i];\n            if (segment.isEmpty()) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID path must not contain empty segments: \" + spiffeId);\n            }\n            if (\".\".equals(segment) || \"..\".equals(segment)) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID path must not contain dot segments: \" + spiffeId);\n            }\n            for (int j = 0; j < segment.length(); j++) {\n                char c = segment.charAt(j);\n                if (!isValidPathChar(c)) {\n                    throw new SpiffeConnectionException(\n                            \"SPIFFE ID path contains invalid character '\" + c + \"': \" + spiffeId);\n                }\n            }\n        }\n    }\n\n    private static String extractOptionalUriSan(X509Certificate cert) {\n        try {\n            var sans = cert.getSubjectAlternativeNames();\n            if (sans == null) {\n                return null;\n            }","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L115-L151","documentation":"SPIFFE ID path segments must not be '.' or '..', which are relative-navigation segments and forbidden by the SPIFFE spec to prevent path-traversal ambiguity. SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when any path segment equals '.' or '..'.","triggerScenarios":"validateSpiffeId called with IDs like 'spiffe://example.org/ns/../sa/app' or IDs produced by relative path resolution (e.g. Paths.get(...).resolve(\"..\")).","commonSituations":"Building IDs from filesystem-style relative paths that were not normalized; templating that substitutes empty/relative components into segment positions; URL-resolving a base ID with '../' segments.","solutions":["Remove '.'/'..' segments and express the final workload path directly","Normalize relative paths before converting them into a SPIFFE ID path","Fix the path-building code so components are absolute, explicit workload identifiers"],"exampleFix":"// before\nString spiffeId = \"spiffe://example.org/ns/\" + ns + \"/../sa/app\";\n// after\nString spiffeId = \"spiffe://example.org/ns/\" + ns + \"/sa/app\";","handlingStrategy":"validation","validationCode":"static boolean noDotSegments(String id) {\n    try {\n        String p = URI.create(id).getPath();\n        if (p == null) return false;\n        for (String s : p.split(\"/\")) {\n            if (s.equals(\".\") || s.equals(\"..\")) return false;\n        }\n        return true;\n    } catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { throw new IllegalArgumentException(\"SPIFFE ID path must not contain '.' or '..'\", e); }","preventionTips":["Normalize (resolve) any relative path before turning it into a SPIFFE ID","Reject '.'/'..' segments in ID templates at build time"],"tags":["spiffe","validation","path","path-traversal","spiffe-id"],"backgroundTag":"spiffe-id-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}