{"record":{"id":"29c1a365aa3bdc49","repo":"apache/hadoop","slug":"invalid-type-of-acl-in-aclspec","errorCode":null,"errorMessage":"Invalid type of acl in <aclSpec> :","messagePattern":"Invalid type of acl in <aclSpec> :","errorType":"validation","errorClass":"HadoopIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/permission/AclEntry.java","lineNumber":291,"sourceCode":"    int index = 0;\n    if (\"default\".equals(split[0])) {\n      // default entry\n      index++;\n      builder.setScope(AclEntryScope.DEFAULT);\n    }\n\n    if (split.length <= index) {\n      throw new HadoopIllegalArgumentException(\"Invalid <aclSpec> : \" + aclStr);\n    }\n\n    AclEntryType aclType = null;\n    try {\n      aclType = Enum.valueOf(\n          AclEntryType.class, StringUtils.toUpperCase(split[index]));\n      builder.setType(aclType);\n      index++;\n    } catch (IllegalArgumentException iae) {\n      throw new HadoopIllegalArgumentException(\n          \"Invalid type of acl in <aclSpec> :\" + aclStr);\n    }\n\n    if (split.length > index) {\n      String name = split[index];\n      if (!name.isEmpty()) {\n        builder.setName(name);\n      }\n      index++;\n    }\n\n    if (includePermission) {\n      if (split.length <= index) {\n        throw new HadoopIllegalArgumentException(\"Invalid <aclSpec> : \"\n            + aclStr);\n      }\n      String permission = split[index];\n      FsAction fsAction = FsAction.getFsAction(permission);","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/permission/AclEntry.java#L273-L309","documentation":"The token following the optional \"default:\" scope must name one of the AclEntryType enum values — user, group, mask, other (matched case-insensitively via Enum.valueOf after uppercasing). Any other token raises IllegalArgumentException, which is converted to HadoopIllegalArgumentException(\"Invalid type of acl in <aclSpec> : ...\").","triggerScenarios":"Typos like \"usr:foo:rwx\" or \"users:foo\"; a name-only spec (\"foo:rwx\") shifting the name into the type slot; missing delimiters from concatenation shifting every field left; tokens with unexpected case that still should match (they do, but anything else fails).","commonSituations":"Hand-written ACL strings in scripts and docs; migrating from POSIX setfacl syntax (u:foo:rw, g::r) where abbreviations are legal; specs built by string concatenation where one ':' goes missing.","solutions":["Correct the type token to one of user, group, mask, other (optionally after the default: prefix)","Validate the type token in user-supplied specs before parsing (see typeGuard)","Generate entries with AclEntry.Builder and AclEntryType constants instead of string parsing"],"exampleFix":"// before\nAclEntry e = AclEntry.parseAclEntry(\"usr:foo:rwx\", true);   // Invalid type of acl\n\n// after\nAclEntry e = AclEntry.parseAclEntry(\"user:foo:rwx\", true); // valid type token","handlingStrategy":"validation","validationCode":"private static final Set<String> ACL_TYPES =\n    Set.of(\"user\", \"group\", \"mask\", \"other\");\n\nString[] parts = aclSpec.split(\":\");\nint i = \"default\".equals(parts[0]) ? 1 : 0;\nif (parts.length <= i || !ACL_TYPES.contains(parts[i].toLowerCase(Locale.ROOT))) {\n  throw new IllegalArgumentException(\"acl type must be user|group|mask|other: \" + aclSpec);\n}","typeGuard":"// type guard: is this string a parseable Hadoop ACL entry type token?\nstatic boolean isValidAclTypeToken(String token) {\n  if (token == null) { return false; }\n  switch (token.toLowerCase(Locale.ROOT)) {\n    case \"user\": case \"group\": case \"mask\": case \"other\":\n      return true;\n    default:\n      return false;\n  }\n}","tryCatchPattern":"catch HadoopIllegalArgumentException from parseAclEntry, check for \"Invalid type of acl\", and correct the type token (user/group/mask/other) before reparsing; keep the original spec in the error report.","preventionTips":["Spell ACL types in full — POSIX abbreviations (u, g) are not accepted","Validate user-supplied ACL strings against a fixed type set before parsing","Generate entries with AclEntry.Builder + AclEntryType constants to eliminate typos"],"tags":["hadoop","acl","validation","parsing","enum"],"backgroundTag":"acl-spec-validation-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}