{"record":{"id":"30af96ff685a9989","repo":"t8y2/dbx","slug":"token-contains-trailing-data-30af96","errorCode":null,"errorMessage":"token contains trailing data","messagePattern":"token contains trailing data","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":796,"sourceCode":"\tidentifier, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"identifier: %w\", err)\n\t}\n\tpassword, err := readHadoopByteArray(reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"password: %w\", err)\n\t}\n\tif len(identifier) == 0 || len(password) == 0 {\n\t\treturn nil, nil, errors.New(\"token identifier and password must be non-empty\")\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"kind: %w\", err)\n\t}\n\tif _, err := readHadoopByteArray(reader); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"service: %w\", err)\n\t}\n\tif reader.Len() != 0 {\n\t\treturn nil, nil, errors.New(\"token contains trailing data\")\n\t}\n\treturn identifier, password, nil\n}\n\nfunc readHadoopByteArray(reader io.ByteReader) ([]byte, error) {\n\tlength, err := readHadoopVInt(reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif length < 0 {\n\t\treturn nil, fmt.Errorf(\"negative length %d\", length)\n\t}\n\tif length > 64*1024*1024 {\n\t\treturn nil, fmt.Errorf(\"length %d exceeds limit\", length)\n\t}\n\tvalue := make([]byte, int(length))\n\tbyteReader, ok := reader.(io.Reader)\n\tif !ok {","sourceCodeStart":778,"sourceCodeEnd":814,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L778-L814","documentation":"After parsing identifier, password, kind, and service byte arrays from the decoded delegation token, the driver requires the remaining buffer to be empty. Leftover bytes indicate the input is longer than a valid Hadoop token structure — extra data, wrong encoding, or concatenated tokens.","triggerScenarios":"Passing a token with trailing junk (whitespace is stripped, but other bytes are not), concatenating two tokens, encoding the token with an extra wrapper (e.g. JSON with quotes base64-encoded), or a version mismatch producing extra fields.","commonSituations":"Copy-paste including trailing characters that survive base64 decoding, pipelines that wrap the token in quotes or JSON before base64, older/newer Hadoop writing extra metadata.","solutions":["Use the raw base64 token string exactly as produced by the Hadoop service, without extra quoting or wrappers.","Trim surrounding quotes/JSON from the value before passing it.","Re-generate the token and avoid manual editing; if tokens are concatenated, pass only one."],"exampleFix":"// before\nparams[\"delegationToken\"] = \"\\\"\" + token + \"extra data\\\"\" // quoted/wrapped\n// after\nparams[\"delegationToken\"] = token // exact base64 from Hive/Hadoop","handlingStrategy":"validation","validationCode":"func cleanTokenString(v string) string {\n    return strings.Trim(strings.TrimSpace(v), \"\\\"'\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass the token exactly as issued; strip quotes/JSON wrappers before use","Never concatenate or manually edit token strings","Store tokens in single-value secrets, not embedded in larger documents"],"tags":["hive","authentication","delegation-token","serialization"],"backgroundTag":"token-format-invalid","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}