{"record":{"id":"4d46b85cbf8569fb","repo":"apache/hadoop","slug":"invalid-value-str-does-not-belong-to-the-doma","errorCode":null,"errorMessage":"Invalid value: \"{str}\" does not belong to the domain {domain}","messagePattern":"Invalid value: \"(.+?)\" does not belong to the domain (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/resources/StringParam.java","lineNumber":53,"sourceCode":"  static final class Domain extends Param.Domain<String> {\n    /** The pattern defining the domain; null . */\n    private final Pattern pattern;\n\n    Domain(final String paramName, final Pattern pattern) {\n      super(paramName);\n      this.pattern = pattern;\n    }\n\n    @Override\n    public final String getDomain() {\n      return pattern == null ? \"<String>\" : pattern.pattern();\n    }\n\n    @Override\n    final String parse(final String str) {\n      if (str != null && pattern != null) {\n        if (!pattern.matcher(str).matches()) {\n          throw new IllegalArgumentException(\"Invalid value: \\\"\" + str\n              + \"\\\" does not belong to the domain \" + getDomain());\n        }\n      }\n      return str;\n    }\n  }\n}\n","sourceCodeStart":35,"sourceCodeEnd":61,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/resources/StringParam.java#L35-L61","documentation":"StringParam.Domain.parse (StringParam.java:47-57) enforces an optional regular expression attached to each string-valued WebHDFS/HttpFS parameter; when pattern.matcher(str).matches() is false it throws this IllegalArgumentException, printing the regex as the domain. Affected parameters include user.name (UserParam, default pattern '^[A-Za-z_][A-Za-z0-9._-]*[$]?$' from DFS_WEBHDFS_USER_PATTERN_DEFAULT), HttpFS's filter (listStatus glob), owner/group, xattr names, and aclspec. The server returns HTTP 400.","triggerScenarios":"user.name='root:adm' or 'user@corp/x' (colon, slash, '@' outside the trailing $ not allowed by the default pattern); owner/group values with spaces or commas in SETOWNER via HttpFS; xattrname not matching the name pattern in SETXATTR; filter containing raw glob metacharacters rejected by the HttpFS filter regex; aclspec with malformed entries in SETACL/MODIFYACLENTRIES.","commonSituations":"Service accounts with unusual characters in names hitting the WebHDFS user pattern; hardening deployments that tightened dfs.webhdfs.user.pattern and suddenly rejecting previously working user.name values; passing DNs/emails as owner; HttpFS fronting non-HDFS file systems where ACL specs differ.","solutions":["Conform the value to the regex printed in the error message — for user.name that means start with a letter/underscore and use only letters, digits, '.', '_', '-', with an optional trailing '$'.","If legitimate usernames are being rejected, adjust the pattern: set dfs.webhdfs.user.pattern on the WebHDFS endpoint to a regex that admits them (UserParam.setUserPattern applies it).","For SETOWNER/xattr/ACL calls, validate the value against the same rules the corresponding *Param class compiles."],"exampleFix":"# before\ncurl -i \"http://nn:9870/webhdfs/v1/f?op=GETFILESTATUS&user.name=svc/etl@CORP\"\n# after\ncurl -i \"http://nn:9870/webhdfs/v1/f?op=GETFILESTATUS&user.name=svc_etl\"\n# (or set -D dfs.webhdfs.user.pattern='^.*@CORP$' style regex on the server)","handlingStrategy":"validation","validationCode":"static final Pattern USER = Pattern.compile(\"^[A-Za-z_][A-Za-z0-9._-]*[$]?$\");\nstatic String checkedUser(String u) {\n  if (!USER.matcher(u).matches()) throw new IllegalArgumentException(\"user.name rejected by WebHDFS pattern: \" + u);\n  return u;\n}","typeGuard":"static boolean matchesUserPattern(String u) { return u != null && USER.matcher(u).matches(); }","tryCatchPattern":null,"preventionTips":["Validate user/owner/group strings against the same regex WebHDFS uses before the request.","If service accounts need richer names, change dfs.webhdfs.user.pattern on the endpoint deliberately and document it.","For HttpFS string params (filter, aclspec, xattr names) validate against each param's documented pattern."],"tags":["webhdfs","query-param","regex-validation","usernames","httpfs"],"backgroundTag":"query-parameter-pattern-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}