{"record":{"id":"5915ea0bb0a5053e","repo":"hashicorp/nomad","slug":"invalid-quota-policy-v","errorCode":null,"errorMessage":"Invalid quota policy: %#v","messagePattern":"Invalid quota policy: %#v","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":723,"sourceCode":"\t\tif p.Sentinel.Policy != \"\" && !isPolicyValid(p.Sentinel.Policy) {\n\t\t\treturn nil, fmt.Errorf(\"Invalid sentinel policy: %#v\", p.Sentinel)\n\t\t}\n\t\tfor _, cap := range p.Sentinel.Capabilities {\n\t\t\tif !isSentinelCapabilityValid(cap) {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid sentinel capability '%s'\", cap)\n\t\t\t}\n\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif p.Sentinel.Policy != \"\" {\n\t\t\textraCap := expandSentinelPolicy(p.Sentinel.Policy)\n\t\t\tp.Sentinel.Capabilities = append(p.Sentinel.Capabilities, extraCap...)\n\t\t}\n\t}\n\n\tif p.Quota != nil && !isPolicyValid(p.Quota.Policy) {\n\t\treturn nil, fmt.Errorf(\"Invalid quota policy: %#v\", p.Quota)\n\t}\n\n\tif p.Plugin != nil && !p.Plugin.isValid() {\n\t\treturn nil, fmt.Errorf(\"Invalid plugin policy: %#v\", p.Plugin)\n\t}\n\treturn p, nil\n}\n\n// hclDecode wraps hcl.Decode function but handles any unexpected panics\nfunc hclDecode(p *Policy, rules string) (err error) {\n\tdefer func() {\n\t\tif rerr := recover(); rerr != nil {\n\t\t\terr = fmt.Errorf(\"invalid acl policy: %v\", rerr)\n\t\t}\n\t}()\n\n\tif err = hcl.Decode(p, rules); err != nil {\n\t\treturn err","sourceCodeStart":705,"sourceCodeEnd":741,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L705-L741","documentation":"This error is returned by acl/policy.go when parsing an ACL policy whose `quota` stanza contains a policy string that fails `isPolicyValid`. The quota policy is validated against an allowlist of valid quota specification formats before the Policy object is accepted. It wraps the whole %#v representation of the Quota struct so the developer can see which quota definition was rejected.","triggerScenarios":"Calling acl.NewPolicy / policy parsing (e.g. from the Consul agent or `consul acl policy` update) with rules containing a `quota { policy = \"...\" }` stanza whose policy value is not in the valid quota policy set (empty string or malformed quota spec).","commonSituations":"Hand-written ACL policy HCL with a typo'd or empty quota policy string; copying policy snippets from docs for an older Consul version; automation templates leaving the quota policy field blank.","solutions":["Fix the `policy` value inside the `quota` stanza so it matches a valid quota policy format expected by isPolicyValid.","Remove the `quota` stanza entirely if quota enforcement is not needed in this policy.","Check the input HCL for stray whitespace, empty assignment (`policy = \"\"`), or encoding issues introduced by templating."],"exampleFix":"// before\nquota {\n  policy = \"\"\n}\n// after\nquota {\n  policy = \"quota-default-10\"\n}","handlingStrategy":"validation","validationCode":"// validate quota stanza before parsing\nif strings.Contains(rules, \"quota {\") {\n    m := regexp.MustCompile(`policy\\s*=\\s*\"([^\"]*)\"`).FindStringSubmatch(rules)\n    if len(m) < 2 || m[1] == \"\" {\n        return fmt.Errorf(\"quota policy must be a non-empty valid policy string\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Template-generate ACL policies from a validated schema rather than free-form strings.","Add a unit test that parses every policy file shipped with your app.","Never ship empty quoted values in policy HCL."],"tags":["acl","policy-validation","hcl","consul"],"backgroundTag":"policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}