{"record":{"id":"60c21a27a7ff1b7a","repo":"apache/druid","slug":"invalid-permission-resource-name-regex-s-does-n","errorCode":null,"errorMessage":"Invalid permission, resource name regex[%s] does not compile.","messagePattern":"Invalid permission, resource name regex\\[(.+?)\\] does not compile\\.","errorType":"http","errorClass":"BasicSecurityDBResourceException","httpStatus":400,"severity":"error","filePath":"extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/entity/BasicAuthorizerPermission.java","lineNumber":56,"sourceCode":"  public BasicAuthorizerPermission(\n      @JsonProperty(\"resourceAction\") ResourceAction resourceAction,\n      @JsonProperty(\"resourceNamePattern\") Pattern resourceNamePattern\n  )\n  {\n    this.resourceAction = resourceAction;\n    this.resourceNamePattern = resourceNamePattern;\n  }\n\n  private BasicAuthorizerPermission(\n      ResourceAction resourceAction\n  )\n  {\n    this.resourceAction = resourceAction;\n    try {\n      this.resourceNamePattern = Pattern.compile(resourceAction.getResource().getName());\n    }\n    catch (PatternSyntaxException pse) {\n      throw new BasicSecurityDBResourceException(\n          pse,\n          \"Invalid permission, resource name regex[%s] does not compile.\",\n          resourceAction.getResource().getName()\n      );\n    }\n  }\n\n  @JsonProperty\n  public ResourceAction getResourceAction()\n  {\n    return resourceAction;\n  }\n\n  @JsonProperty\n  public Pattern getResourceNamePattern()\n  {\n    return resourceNamePattern;\n  }","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/entity/BasicAuthorizerPermission.java#L38-L74","documentation":"When a BasicAuthorizerPermission is built from a ResourceAction (the internal representation path), the resource name is compiled as a Java regex to produce resourceNamePattern. If the stored resource name contains invalid regex syntax (e.g. an unbalanced '[' or dangling '*'), Pattern.compile throws PatternSyntaxException and the permission is rejected with BasicSecurityDBResourceException — the persisted permission data itself is malformed.","triggerScenarios":"Thrown at extensions-core/druid-basic-security/src/main/java/org/apache/druid/security/basic/authorization/entity/BasicAuthorizerPermission.java:56 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Locate the role permission with the invalid resource-name regex (it may have been written directly to the metadata store or via an older API)","Fix or remove the bad permission and re-save it with a valid regex; escape literal metacharacters (e.g. use \\. for dots)","Restore a consistent authorizer state from backup if many permissions are corrupted"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}