{"record":{"id":"3f3a033b0ffb6abb","repo":"hashicorp/nomad","slug":"invalid-name-s","errorCode":null,"errorMessage":"invalid name '%s'","messagePattern":"invalid name '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":371,"sourceCode":"\ta.Hash = hashVal\n\treturn hashVal\n}\n\nfunc (a *ACLPolicy) Stub() *ACLPolicyListStub {\n\treturn &ACLPolicyListStub{\n\t\tName:        a.Name,\n\t\tDescription: a.Description,\n\t\tJobACL:      a.JobACL,\n\t\tHash:        a.Hash,\n\t\tCreateIndex: a.CreateIndex,\n\t\tModifyIndex: a.ModifyIndex,\n\t}\n}\n\nfunc (a *ACLPolicy) Validate() error {\n\tvar mErr multierror.Error\n\tif !ValidPolicyName.MatchString(a.Name) {\n\t\terr := fmt.Errorf(\"invalid name '%s'\", a.Name)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif _, err := acl.Parse(a.Rules, acl.PolicyParseStrict); err != nil {\n\t\terr = fmt.Errorf(\"failed to parse rules: %v\", err)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif len(a.Description) > maxPolicyDescriptionLength {\n\t\terr := fmt.Errorf(\"description longer than %d\", maxPolicyDescriptionLength)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\tif a.JobACL != nil {\n\t\tif a.JobACL.JobID != \"\" && a.JobACL.Namespace == \"\" {\n\t\t\terr := fmt.Errorf(\"namespace must be set to set job ID\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)\n\t\t}\n\t\tif a.JobACL.Group != \"\" && a.JobACL.JobID == \"\" {\n\t\t\terr := fmt.Errorf(\"job ID must be set to set group\")\n\t\t\tmErr.Errors = append(mErr.Errors, err)","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L353-L389","documentation":"ACLPolicy.Validate in nomad/structs/acl.go rejects a policy whose Name does not match the ValidPolicyName regex. Nomad restricts ACL policy names to a safe character set so names can be used in file paths and API URLs unambiguously. The error is accumulated into a multierror together with any other validation failures.","triggerScenarios":"Submitting an ACL policy via the ACL policy create/update API (or `nomad acl policy apply`) with a name containing characters outside the allowed set (the regex permits alphanumeric, dash, underscore; leading/trailing dashes and dotdot-style traversal names are rejected).","commonSituations":"Typing a policy name with spaces, dots, slashes or shell-unfriendly characters; scripting policy creation from filenames like 'my policy.hcl'; attempting path-traversal style names ('..'); older configs created before strict name validation.","solutions":["Rename the policy to contain only valid characters (alphanumerics, dashes, underscores) and resubmit.","Check `nomad acl policy info <name>`/the API response for the exact invalid name reported.","If importing policies from files, sanitize filenames before deriving the policy name.","Upgrade/downgrade awareness: names valid in old clusters may fail strict validation on newer servers; rename or export with corrected names."],"exampleFix":"// before\npolicy.Name = \"team prod read\"\n// after\npolicy.Name = \"team-prod-read\"","handlingStrategy":"validation","validationCode":"var validPolicyName = regexp.MustCompile(`^[a-zA-Z0-9-[\\]]+$`)\nfunc validatePolicyName(name string) error {\n    if !validPolicyName.MatchString(name) {\n        return fmt.Errorf(\"policy name %q contains invalid characters\", name)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"err := policy.Validate()\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid name\") {\n        return fmt.Errorf(\"rename policy: %w\", err)\n    }\n    return err\n}","preventionTips":["Derive policy names from sanitized identifiers (slugify filenames before applying).","Restrict names to alphanumerics, dashes, underscores in your tooling.","Add a pre-apply lint step for policy names in CI.","Avoid spaces, dots, slashes and path-traversal sequences in names."],"tags":["acl","validation","naming"],"backgroundTag":"acl-policy-name-invalid","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}