{"record":{"id":"2d1be7e0feb329d6","repo":"gravitational/teleport","slug":"invalid-attributetype-bad-character-set-q","errorCode":null,"errorMessage":"invalid attributeType (bad character set): %q","messagePattern":"invalid attributeType \\(bad character set\\): %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/utils/pkixname/parser.go","lineNumber":177,"sourceCode":"\n\t// Pop tokens before returning. We retain the tokens up until the end so\n\t// eventual errors include them in the message.\n\tdefer func() {\n\t\ttokens.PopSilently()\n\t\ttokens.PopSilently()\n\t\ttokens.PopSilently()\n\t}()\n\n\tattr = t1.value\n\tvalue := t3.value\n\n\t// Parse as OID?\n\tif oidRegexp.MatchString(attr) {\n\t\treturn attr, parseOIDExtraName(dst, attr, value)\n\t}\n\t// Verify attributeType character set.\n\tif !attrTypeRegexp.MatchString(attr) {\n\t\treturn \"\", fmt.Errorf(\"invalid attributeType (bad character set): %q\", attr)\n\t}\n\n\tswitch attr {\n\tcase \"SERIALNUMBER\":\n\t\tdst.SerialNumber = value\n\tcase \"CN\":\n\t\tdst.CommonName = value\n\tcase \"OU\":\n\t\tdst.OrganizationalUnit = append(dst.OrganizationalUnit, value)\n\tcase \"O\":\n\t\tdst.Organization = append(dst.Organization, value)\n\tcase \"POSTALCODE\":\n\t\tdst.PostalCode = append(dst.PostalCode, value)\n\tcase \"STREET\":\n\t\tdst.StreetAddress = append(dst.StreetAddress, value)\n\tcase \"L\":\n\t\tdst.Locality = append(dst.Locality, value)\n\tcase \"ST\":","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/utils/pkixname/parser.go#L159-L195","documentation":"Attribute types that are not numeric OIDs must match attrTypeRegexp: start with a letter, followed by letters, digits or hyphens. Because the tokenizer also accepts '.' and digits in attribute positions, an attribute like '2.5x' or 'foo.bar' reaches parseATV, fails the OID regexp, then fails this character-set check and is rejected.","triggerScenarios":"Attribute types containing dots (other than pure OIDs), underscores, leading digits mixed with non-OID shapes, or other symbols: ParseDistinguishedName('CN.NAME=x'), ParseDistinguishedName('1a.2b=v'), or 'OID.CN=x' (dot-prefixed forms).","commonSituations":"Users write 'oid.2.5.4.3=x' or 'OID.CN=x' which the parser explicitly does not support (documented deviation), or use snake_case attribute names like 'common_name' which fail the letter-start/charset rule.","solutions":["Use plain short attribute names: CN, O, OU, C, ST, L, STREET, POSTALCODE, SERIALNUMBER","For custom attributes, use a bare numeric OID without an 'oid.' prefix, e.g. '1.2.3.4=value'","Replace underscores or dots in custom names with hyphens (still letter-first), or use an OID form","Remove 'oid.'/'OID.' prefixes — they are documented as unsupported"],"exampleFix":"// before\nParseDistinguishedName(\"oid.2.5.4.3=proxy\")\n// after\nParseDistinguishedName(\"CN=proxy\")","handlingStrategy":"validation","validationCode":"var attrTypeRe = regexp.MustCompile(`^[A-Za-z]([A-Za-z0-9-])*$`)\nvar oidRe = regexp.MustCompile(`^\\d+(\\.\\d+)*$`)\nfunc attrTypeValid(dn string) error {\n\tfor _, part := range strings.Split(dn, \",\") {\n\t\tkv := strings.SplitN(strings.TrimSpace(part), \"=\", 2)\n\t\tif len(kv) == 2 && !oidRe.MatchString(kv[0]) && !attrTypeRe.MatchString(kv[0]) {\n\t\t\treturn fmt.Errorf(\"attribute type %q has invalid characters\", kv[0])\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := attrTypeValid(dn); err != nil { return err }\nname, err := pkixname.ParseDistinguishedName(dn)\nif err != nil { return fmt.Errorf(\"invalid DN %q: %w\", dn, err) }","preventionTips":["Attribute names: letter first, then letters/digits/hyphens only — no dots, underscores, or 'oid.' prefixes","Custom attributes must be bare numeric OIDs ('1.2.3.4=x')","Strip 'oid.'/'OID.' prefixes which this parser explicitly does not support"],"tags":["x509","distinguished-name","parsing","validation"],"backgroundTag":"invalid-attribute-type-name","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}