{"record":{"id":"5b155e3c20eaf622","repo":"quarkusio/quarkus","slug":"spiffe-id-must-not-contain-percent-encoded-charact","errorCode":null,"errorMessage":"SPIFFE ID must not contain percent-encoded characters: ${spiffeId}","messagePattern":"SPIFFE ID must not contain percent-encoded characters: (.+?)","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":79,"sourceCode":"                        \"Signing certificate SPIFFE ID must not have a path component: \" + uriSan);\n            }\n        }\n    }\n\n    static void validateSpiffeId(String spiffeId) throws SpiffeConnectionException {\n        if (spiffeId == null || spiffeId.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not be empty\");\n        }\n        if (spiffeId.length() > MAX_SPIFFE_ID_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID exceeds maximum length of \" + MAX_SPIFFE_ID_LENGTH\n                    + \" bytes: \" + spiffeId.length());\n        }\n\n        if (!spiffeId.startsWith(SPIFFE_URI_PREFIX)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have 'spiffe://' scheme: \" + spiffeId);\n        }\n        if (spiffeId.contains(\"%\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain percent-encoded characters: \" + spiffeId);\n        }\n\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L61-L97","documentation":"SPIFFE IDs must not contain percent-encoded characters (%xx); SPIFFE URIs are plain UTF-8 and encoding would make IDs ambiguous. SpiffeValidator.validateSpiffeId rejects any ID containing '%' with SpiffeConnectionException.","triggerScenarios":"An ID built from URL-encoded components, e.g. URLEncoder.encode applied to path segments producing spiffe://example.org/ns/d%2Fdefault, then passed to validation.","commonSituations":"Reusing URL-building utilities (URLEncoder/UriBuilder) to construct SPIFFE IDs; embedding user-controlled or encoded path data in identity templates.","solutions":["Build the SPIFFE ID from raw, unencoded UTF-8 path segments joined with '/'.","Remove URLEncoder/percent-encoding from the identity construction code.","Sanitize or reject inputs containing '%' before forming the ID."],"exampleFix":"// before\nString id = \"spiffe://example.org/ns/\" + URLEncoder.encode(ns, UTF_8);\n// after\nString id = \"spiffe://example.org/ns/\" + ns; // ns must not contain reserved chars","handlingStrategy":"validation","validationCode":"if (spiffeId.indexOf('%') >= 0) {\n    throw new IllegalStateException(\"SPIFFE ID must not be percent-encoded: \" + spiffeId);\n}","typeGuard":null,"tryCatchPattern":"try {\n    connection.establish();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"percent-encoded\")) {\n        log.error(\"SPIFFE ID was URL-encoded during construction; use raw segments\", e);\n    }\n    throw e;\n}","preventionTips":["Never use URLEncoder for SPIFFE ID path segments","Join raw, validated segments with '/'","Reject '%' in identity-related user input early"],"tags":["spiffe","validation","uri-encoding"],"backgroundTag":"spiffe-id-validation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}