{"record":{"id":"43e4bbb585358ac8","repo":"microsoft/garnet","slug":"unable-to-parse-input-password-hash-the-input-is","errorCode":null,"errorMessage":"Unable to parse input password hash. The input is of wrong length.","messagePattern":"Unable to parse input password hash\\. The input is of wrong length\\.","errorType":"validation","errorClass":"ACLPasswordException","httpStatus":null,"severity":"error","filePath":"libs/server/ACL/ACLPassword.cs","lineNumber":51,"sourceCode":"        /// <param name=\"password\">Cleartext password used to initialize the password hash.</param>\n        /// <returns>ACLPassword object for the given cleartext password.</returns>\n        public static ACLPassword ACLPasswordFromString(string password)\n        {\n            byte[] hash = SHA256.HashData(Encoding.UTF8.GetBytes(password));\n            return new ACLPassword(hash);\n        }\n\n        /// <summary>\n        /// Initializes a new ACLPassword from the given string representation of a password hash.\n        /// </summary>\n        /// <param name=\"hashString\">A hex-string containing a valid SHA-265 password hash.</param>\n        /// <returns>ACLPassword object with the given hash.</returns>\n        /// <exception cref=\"ACLPasswordException\">Thrown when the given input string cannot be parsed.</exception>\n        public static ACLPassword ACLPasswordFromHash(string hashString)\n        {\n            if (hashString.Length != 2 * NumHashBytes)\n            {\n                throw new ACLPasswordException(\"Unable to parse input password hash. The input is of wrong length.\");\n            }\n\n            // Parse input byte by byte\n            byte[] hash = new byte[NumHashBytes];\n            try\n            {\n                for (int i = 0; i < hash.Length; i++)\n                {\n                    string byteString = hashString.Substring(i * 2, 2);\n                    hash[i] = byte.Parse(byteString, NumberStyles.HexNumber, CultureInfo.InvariantCulture);\n                }\n            }\n            catch (FormatException)\n            {\n                throw new ACLPasswordException(\"Unable to parse input password hash. The input is not of the correct format.\");\n            }\n\n            return new ACLPassword(hash);","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/server/ACL/ACLPassword.cs#L33-L69","documentation":"Thrown by ACLPassword.ACLPasswordFromHash when the supplied hash string is not exactly 64 characters (2 * 32 bytes, since SHA-256 produces 32 bytes and each is 2 hex chars). A wrong-length input cannot represent a valid SHA-256 hash and is rejected with ACLPasswordException before any byte parsing.","triggerScenarios":"Passing a hash that is too short (e.g. a 40-char SHA-1 hash) or too long (e.g. a 128-char SHA-512 hash, or 64 hex chars plus a trailing newline/space), or a raw password string mistaken for a hash.","commonSituations":"Using the output of sha1sum or sha512sum instead of sha256sum; copying a hash with a trailing newline from a shell; passing the base64 form; a truncated copy-paste.","solutions":["Generate the hash with SHA-256 and output 64 hex characters (sha256sum, or SHA256.HashData then hex-encode).","Trim whitespace/newlines from the hash before passing.","If you have the cleartext, use ACLPassword.ACLPasswordFromString instead, which hashes for you.","Validate hashString.Length == 64 before calling."],"exampleFix":"// before\nvar p = ACLPassword.ACLPasswordFromHash(sha1Hash); // 40 chars\n\n// after\nvar p = ACLPassword.ACLPasswordFromHash(sha256Hex.Trim()); // 64 hex chars","handlingStrategy":"validation","validationCode":"if (hashString == null || hashString.Length != 64)\n    throw new ArgumentException(\"Password hash must be exactly 64 hex characters (SHA-256).\");","typeGuard":"static bool IsCorrectHashLength(string s) => s != null && s.Length == 64;","tryCatchPattern":"try { var p = ACLPassword.ACLPasswordFromHash(hash); }\ncatch (ACLPasswordException ex) when (ex.Message.Contains(\"length\")) { /* regenerate as SHA-256 */ }","preventionTips":["Always use SHA-256 (32 bytes -> 64 hex chars).","Trim trailing newlines from shell-generated hashes.","Use ACLPasswordFromString when you have the cleartext."],"tags":["acl","password","hash","sha256","validation"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}