{"record":{"id":"5e0a28c154a5d369","repo":"apache/hadoop","slug":"invalid-permission-in-permission-string","errorCode":null,"errorMessage":"Invalid permission '{}' in permission string '{}'","messagePattern":"Invalid permission '(.+?)' in permission string '(.+?)'","errorType":"exception","errorClass":"BadAclFormatException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/ZKUtil.java","lineNumber":65,"sourceCode":"      char c = permString.charAt(i); \n      switch (c) {\n      case 'r':\n        perm |= ZooDefs.Perms.READ;\n        break;\n      case 'w':\n        perm |= ZooDefs.Perms.WRITE;\n        break;\n      case 'c':\n        perm |= ZooDefs.Perms.CREATE;\n        break;\n      case 'd':\n        perm |= ZooDefs.Perms.DELETE;\n        break;\n      case 'a':\n        perm |= ZooDefs.Perms.ADMIN;\n        break;\n      default:\n        throw new BadAclFormatException(\n            \"Invalid permission '\" + c + \"' in permission string '\" +\n            permString + \"'\");\n      }\n    }\n    return perm;\n  }\n\n  /**\n   * Helper method to remove a subset of permissions (remove) from a\n   * given set (perms).\n   * @param perms The permissions flag to remove from. Should be an OR of a\n   *              some combination of {@link ZooDefs.Perms}\n   * @param remove The permissions to be removed. Should be an OR of a\n   *              some combination of {@link ZooDefs.Perms}\n   * @return A permissions flag that is an OR of {@link ZooDefs.Perms}\n   * present in perms and not present in remove\n   */\n  public static int removeSpecificPerms(int perms, int remove) {","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/ZKUtil.java#L47-L83","documentation":"ZKUtil's ACL parser (used when converting ZooKeeper ACL configuration strings into org.apache.zookeeper.data.ACL objects) parses only the perm segment letters r, w, c, d, a (READ, WRITE, CREATE, DELETE, ADMIN). Any other character in the permission part of an entry triggers BadAclFormatException with this message, which extends HadoopIllegalArgumentException.","triggerScenarios":"ZKUtil.stringToACLs / parseAcls with entries like \"world:anyone:rwxa\" ('x' invalid), \"sasl:hdfs:read\" ('read' is not a letter sequence the switch understands — 'r' works, 'e' from 'read' then fails), or \"world:anyone:*\"; reached indirectly from services parsing ZooKeeper ACL config values (e.g. YARN registry 'hadoop.registry.zk.acl').","commonSituations":"Writing descriptive permissions ('read', 'write', 'all') instead of the letter codes; copying ZooKeeper docs that show 'cdrwa' (valid) but mistyping a letter; a trailing character from manual config edits; using 'x' for execute by analogy with POSIX modes.","solutions":["Use only the letters r, w, c, d, a in the permission segment, e.g. \"world:anyone:rwcda\".","Fix the config value (typically the ZooKeeper ACL property consumed by ZKUtil) to use letter codes.","Pre-validate each comma-separated entry with a regex like ^[^:]+:[^:]*:[rwcda]+$ before passing it to ZKUtil.","Catch BadAclFormatException at config load and report the malformed ACL entry."],"exampleFix":"// before\nList<ACL> acls = ZKUtil.stringToACLs(\"world:anyone:read\");\n// throws: Invalid permission 'e' in permission string 'read'\n\n// after\nList<ACL> acls = ZKUtil.stringToACLs(\"world:anyone:r\");","handlingStrategy":"validation","validationCode":"private static final Pattern ACL_ENTRY =\n    Pattern.compile(\"^[^:,]+:[^:,]*:[rwcda]*$\");\n\nstatic void validateAclString(String acl) {\n  for (String entry : acl.split(\",\")) {\n    if (!ACL_ENTRY.matcher(entry).matches()) {\n      throw new IllegalArgumentException(\n          \"Bad ACL entry '\" + entry + \"': perms may only contain r,w,c,d,a\");\n    }\n  }\n}\n\nvalidateAclString(aclConf); // before ZKUtil.stringToACLs(aclConf)","typeGuard":null,"tryCatchPattern":"try {\n  List<ACL> acls = ZKUtil.stringToACLs(aclConf);\n} catch (ZKUtil.BadAclFormatException e) {\n  throw new ConfigurationException(\n      \"Invalid ZooKeeper ACL config: \" + e.getMessage(), e);\n}","preventionTips":["Document ACL entries as scheme:id:perm with perms from {r,w,c,d,a} next to every zk acl config key.","Validate ACL config at service startup, before any ZooKeeper connection is attempted.","Use linter/test fixtures for canonical entries like world:anyone:rwcda."],"tags":["zookeeper","acl","configuration","validation","hadoop-common"],"backgroundTag":"zookeeper-acl-invalid","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}