{"record":{"id":"337e0713bebbca1a","repo":"SonarSource/sonarqube","slug":"provided-json-is-invalid-s-at-s","errorCode":null,"errorMessage":"Provided JSON is invalid : [%s at %s]","messagePattern":"Provided JSON is invalid : \\[(.+?) at (.+?)\\]","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/setting/ws/SettingValidations.java","lineNumber":214,"sourceCode":"    private void validateJson(SettingData data, PropertyDefinition definition) {\n      Optional<String> jsonContent = data.values.stream().findFirst();\n      if (jsonContent.isPresent()) {\n        try {\n          new Gson().getAdapter(JsonElement.class).fromJson(jsonContent.get());\n          validateJsonSchema(jsonContent.get(), definition);\n        } catch (JsonParseException | IOException e) {\n          throw new IllegalArgumentException(\"Provided JSON is invalid\");\n        }\n      }\n    }\n\n    private void validateJsonSchema(String json, PropertyDefinition definition) {\n      if (SECURITY_JSON_PROPERTIES.contains(definition.key())) {\n        JsonValue jsonToValidate = new JsonParser(json).parse();\n        Optional.ofNullable(schemaValidator.validate(jsonToValidate))\n          .ifPresent(validationFailure -> {\n            ValidationFailure rootCause = getRootCause(validationFailure);\n            throw new IllegalArgumentException(String.format(\"Provided JSON is invalid : [%s at %s]\", rootCause.getMessage(), rootCause.getInstance().getLocation()));\n          });\n      }\n    }\n\n    private static ValidationFailure getRootCause(ValidationFailure base) {\n      return base.getCauses().stream()\n        .map(ValueTypeValidation::getRootCause)\n        .findFirst()\n        .orElse(base);\n    }\n  }\n}\n","sourceCodeStart":196,"sourceCodeEnd":227,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/setting/ws/SettingValidations.java#L196-L227","documentation":"After parseable JSON is confirmed, validateJsonSchema checks security-relevant JSON settings (SECURITY_JSON_PROPERTIES) against a JSON schema using schemaValidator. When validation fails, the first root-cause ValidationFailure's message and instance location are embedded into the message, telling the developer exactly which part of the payload violates the schema.","triggerScenarios":"POST api/settings/set for a key in SECURITY_JSON_PROPERTIES whose JSON parses but violates the schema: wrong property types, missing required fields, unknown fields, or nested objects failing validation.","commonSituations":"Upgrades that tightened the schema for security settings while older automation still posts the legacy shape; hand-built payloads missing a required field; values copied from third-party integrations with a different structure.","solutions":["Read the [%s at %s] part of the message to locate the offending field and fix its type/structure","Check the property definition / schema for that setting key and conform to it","Pin and update integration tooling after SonarQube version upgrades that changed the schema"],"exampleFix":"// before\n{\"groups\": [1, 2]}          // schema expects strings\n// after\n{\"groups\": [\"group-a\", \"group-b\"]}","handlingStrategy":"validation","validationCode":"// fetch schema from api/settings/definitions and validate client-side before posting\nconst schema = definitions.find(d => d.key === key)?.jsonSchema;\nconst errors = schema ? validateAgainstSchema(JSON.parse(value), schema) : [];\nif (errors.length) throw new Error('Schema violations: ' + errors.join('; '));","typeGuard":null,"tryCatchPattern":"try { await setSetting(key, json); } catch (e) { const m = e.message.match(/\\[(.*) at (.*)\\]/); if (m) console.error(`Schema violation '${m[1]}' at ${m[2]}`); throw e; }","preventionTips":["Parse the '[message at location]' part of the message to pinpoint the bad field","Re-validate stored JSON after SonarQube upgrades (schemas can tighten)","Keep integration payloads in versioned fixtures tested against the schema"],"tags":["json","schema","validation","security"],"backgroundTag":"schema-validation-failed","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}