{"record":{"id":"2b1e4960ea308953","repo":"risingwavelabs/risingwave","slug":"decode-utf8-error-0","errorCode":null,"errorMessage":"decode utf8 error: {0}","messagePattern":"decode utf8 error: (.+?)","errorType":"exception","errorClass":"SecretError","httpStatus":null,"severity":"error","filePath":"src/common/secret/src/error.rs","lineNumber":28,"sourceCode":"// distributed under the License is distributed on an \"AS IS\" BASIS,\n// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n// See the License for the specific language governing permissions and\n// limitations under the License.\n\npub use anyhow::anyhow;\nuse thiserror::Error;\nuse thiserror_ext::Construct;\n\nuse super::SecretId;\n\npub type SecretResult<T> = Result<T, SecretError>;\n\n#[derive(Error, Debug, Construct)]\npub enum SecretError {\n    #[error(\"secret not found: {0}\")]\n    ItemNotFound(SecretId),\n\n    #[error(\"decode utf8 error: {0}\")]\n    DecodeUtf8Error(#[from] std::string::FromUtf8Error),\n\n    #[error(\"I/O error: {0}\")]\n    IoError(#[from] std::io::Error),\n\n    #[error(\"unspecified secret ref type: {0}\")]\n    UnspecifiedRefType(SecretId),\n\n    #[error(\"failed to encrypt or decrypt the secret\")]\n    AesError,\n\n    #[error(\"ser/de proto message error: {0}\")]\n    ProtoError(#[from] bincode::Error),\n\n    #[error(transparent)]\n    Internal(#[from] anyhow::Error),\n}\n","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/common/secret/src/error.rs#L10-L46","documentation":"SecretError::DecodeUtf8Error wraps std::string::FromUtf8Error and is raised when secret bytes retrieved from storage are not valid UTF-8. Secret values are handled as Rust Strings internally, so non-UTF-8 bytes (e.g. binary data stored directly as the secret) cannot be decoded.","triggerScenarios":"Storing raw binary (non-UTF-8) bytes as a secret value and then reading it back via the secret manager, where conversion `String::from_utf8` fails and is converted with #[from] into SecretError::DecodeUtf8Error.","commonSituations":"Writing binary keys or certificates (DER, PKCS#12) directly as secret content instead of PEM/base64; a misconfigured external secret backend returning bytes in an unexpected encoding (e.g. UTF-16); corrupted secret entries in the backing store.","solutions":["Store textual/base64-encoded content in the secret instead of raw binary bytes.","Base64-encode binary material before storing, and decode it after retrieval.","Inspect the secret value's encoding; re-create the secret with UTF-8 content.","Fix the upstream secret provider so it returns UTF-8 encoded values."],"exampleFix":"// before\nlet bytes: Vec<u8> = load_der_key();\nmanager.create(id, bytes)?; // fails on read: not UTF-8\n\n// after\nuse base64::Engine;\nlet encoded = base64::engine::general_purpose::STANDARD.encode(load_der_key());\nmanager.create(id, encoded)?; // store base64 text; decode after read","handlingStrategy":"validation","validationCode":"// Validate secret bytes are UTF-8 before storing:\nfn ensure_utf8(bytes: &[u8]) -> Result<&str, std::str::Utf8Error> {\n    std::str::from_utf8(bytes)\n}","typeGuard":"fn is_utf8_secret(bytes: &[u8]) -> bool {\n    std::str::from_utf8(bytes).is_ok()\n}","tryCatchPattern":"let secret = match manager.get(id).await {\n    Ok(s) => s,\n    Err(SecretError::DecodeUtf8Error(e)) => {\n        // re-create the secret with base64-encoded content\n        return Err(anyhow!(\"secret bytes not UTF-8 ({e}); re-create with base64\"));\n    }\n    Err(e) => return Err(e.into()),\n};","preventionTips":["Store only text (or base64-encoded binary) as secret values.","Base64-encode DER/certificate binaries before storing them as secrets.","Verify the external secret provider returns UTF-8 encoded values.","Decode base64 back to bytes only after reading, in application code."],"tags":["secret","utf8","encoding"],"backgroundTag":"type-mismatch","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}