{"record":{"id":"63bc22d80a25c9d1","repo":"apache/beam","slug":"the-provided-allow-list-does-not-enable-expanding-a","errorCode":null,"errorMessage":"The provided allow list does not enable expanding a transform class by the name ${className}.","messagePattern":"The provided allow list does not enable expanding a transform class by the name (.+?)\\.","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"sdks/java/expansion-service/src/main/java/org/apache/beam/sdk/expansion/service/JavaClassLookupTransformProvider.java","lineNumber":548,"sourceCode":"    }\n\n    public abstract String getVersion();\n\n    public abstract List<AllowedClass> getAllowedClasses();\n\n    public AllowedClass getAllowedClass(String className) {\n      AllowedClass allowlistClass = null;\n      for (AllowedClass cls : getAllowedClasses()) {\n        if (cls.isAllowedClass(className)) {\n          if (allowlistClass != null) {\n            throw new IllegalArgumentException(\n                \"Found two matching allowlist classes \" + allowlistClass + \" and \" + cls);\n          }\n          allowlistClass = cls;\n        }\n      }\n      if (allowlistClass == null) {\n        throw new UnsupportedOperationException(\n            \"The provided allow list does not enable expanding a transform class by the name \"\n                + className\n                + \".\");\n      }\n      return allowlistClass;\n    }\n\n    static AllowList create(String version, List<AllowedClass> allowedClasses) {\n      if (allowedClasses == null) {\n        allowedClasses = new ArrayList<>();\n      }\n      return new AutoValue_JavaClassLookupTransformProvider_AllowList(version, allowedClasses);\n    }\n  }\n\n  @AutoValue\n  public abstract static class AllowedClass {\n","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/expansion-service/src/main/java/org/apache/beam/sdk/expansion/service/JavaClassLookupTransformProvider.java#L530-L566","documentation":"getAllowedClass found no allowlist entry whose isAllowedClass matches the requested class name, so the expansion service refuses to instantiate that transform class. This UnsupportedOperationException signals the class is not permitted by the current allowlist.","triggerScenarios":"Requesting expansion of a class not listed in allowlist YAML; class listed under a different fully-qualified name; the service loaded a stale/different allowlist file.","commonSituations":"Adding a new transform without updating the allowlist; class renamed/moved packages; wrong allowlist mounted in the container.","solutions":["Add the fully-qualified class name (or wildcard package entry) to allowedClasses in the allowlist YAML.","Verify the requested className exactly matches the entry (package, class, case).","Redeploy/restart the expansion service after editing the allowlist."],"exampleFix":"# before\nallowedClasses:\n  - className: org.apache.beam.sdk.transforms.MapElements\n# after\nallowedClasses:\n  - className: org.apache.beam.sdk.transforms.MapElements\n  - className: com.mycompany.transforms.MyTransform","handlingStrategy":"validation","validationCode":"boolean allowed = provider.getAllowedClasses().stream()\n    .anyMatch(c -> c.isAllowedClass(requestedClassName));\nif (!allowed) throw new IllegalArgumentException(\"Class not in allowlist: \" + requestedClassName);","typeGuard":"Optional<AllowedClass> findAllowed(AllowList list, String cn) { return list.getAllowedClasses().stream().filter(c -> c.isAllowedClass(cn)).findFirst(); }","tryCatchPattern":"try { AllowedClass ac = provider.getAllowedClass(className); } catch (UnsupportedOperationException e) { log.warn(\"Class not allowed: {}\", className); throw new ExpansionNotAllowedException(e); }","preventionTips":["Update allowlist in the same PR as new transform registrations","Compare fully-qualified names byte-for-byte","Version and smoke-test the allowlist config","Log the loaded allowlist at service startup"],"tags":["allowlist","security","configuration"],"backgroundTag":"resource-not-found","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}