{"record":{"id":"2ac1dc45efb375bf","repo":"grpc/grpc-java","slug":"unknown-path-matcher-rule-type-proto-getrulec","errorCode":null,"errorMessage":"Unknown path matcher rule type: \" + proto.getRuleCase()","messagePattern":"Unknown path matcher rule type: \" \\+ proto\\.getRuleCase\\(\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"xds/src/main/java/io/grpc/xds/RbacFilter.java","lineNumber":312,"sourceCode":"      case URL_PATH:\n        return parsePathMatcher(principal.getUrlPath());\n      case METADATA: // hard coded, never match.\n        return InvertMatcher.create(AlwaysTrueMatcher.INSTANCE);\n      case IDENTIFIER_NOT_SET:\n      default:\n        throw new IllegalArgumentException(\n                \"Unknown principal identifier case: \" + principal.getIdentifierCase());\n    }\n  }\n\n  private static PathMatcher parsePathMatcher(\n          io.envoyproxy.envoy.type.matcher.v3.PathMatcher proto) {\n    switch (proto.getRuleCase()) {\n      case PATH:\n        return PathMatcher.create(MatcherParser.parseStringMatcher(proto.getPath()));\n      case RULE_NOT_SET:\n      default:\n        throw new IllegalArgumentException(\n                \"Unknown path matcher rule type: \" + proto.getRuleCase());\n    }\n  }\n\n  private static RequestedServerNameMatcher parseRequestedServerNameMatcher(\n          io.envoyproxy.envoy.type.matcher.v3.StringMatcher proto) {\n    return RequestedServerNameMatcher.create(MatcherParser.parseStringMatcher(proto));\n  }\n\n  private static AuthHeaderMatcher parseHeaderMatcher(\n          io.envoyproxy.envoy.config.route.v3.HeaderMatcher proto) {\n    if (proto.getName().startsWith(\"grpc-\")) {\n      throw new IllegalArgumentException(\"Invalid header matcher config: [grpc-] prefixed \"\n          + \"header name is not allowed.\");\n    }\n    if (\":scheme\".equals(proto.getName())) {\n      throw new IllegalArgumentException(\"Invalid header matcher config: header name [:scheme] \"\n          + \"is not allowed.\");","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/xds/src/main/java/io/grpc/xds/RbacFilter.java#L294-L330","documentation":"An Envoy PathMatcher proto must have its 'rule' oneof set to PATH (with a StringMatcher). parsePathMatcher throws IllegalArgumentException when the oneof is RULE_NOT_SET or an unrecognized new case, because the RBAC url_path matchers cannot be built.","triggerScenarios":"parsePermission or parsePrincipal process a Permission/Principal with a url_path field whose PathMatcher proto has no rule set, or contains a rule case added in a newer Envoy API than the client's protos.","commonSituations":"Hand-written RBAC fixtures omitting the path inside url_path; control plane using newer matcher features (e.g. new path match variants) not present in the client's envoy-type protos; malformed policy JSON from a custom xDS server.","solutions":["Set the path rule explicitly in the url_path matcher, e.g. {path: {prefix: \"/api\"}}","Upgrade grpc-xds/envoy protos if a new rule case is being sent","Replace unsupported path rule types with a supported StringMatcher form (prefix/exact/regex/safe_regex)","Check the appended rule case in the message to see which case arrived"],"exampleFix":"# before\nurl_path: {}\n# after\nurl_path:\n  path: {prefix: \"/api\"}","handlingStrategy":"validation","validationCode":"if (pathMatcher.getRuleCase() != PathMatcher.RuleCase.PATH) {\n  throw new IllegalArgumentException(\"url_path matcher must set a path rule\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  Matcher m = parsePathMatcher(proto);\n} catch (IllegalArgumentException e) {\n  logger.warning(\"Bad path matcher: \" + e.getMessage());\n  // reject the RBAC config containing it\n}","preventionTips":["Always populate url_path.path with a StringMatcher","Use standard prefix/exact/regex StringMatcher forms","Keep envoy-type protos in sync between control plane and client"],"tags":["grpc","xds","rbac","path-matcher","protobuf"],"backgroundTag":"unsupported-enum-value","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}