{"record":{"id":"68079e21e642bf05","repo":"nats-io/nats-server","slug":"generated-invalid-subject","errorCode":null,"errorMessage":"generated invalid subject","messagePattern":"generated invalid subject","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":596,"sourceCode":"\t\t\t\t\t} else if failOnBadSubject {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"generated invalid subject %q: %q is not defined\", list[i], match[1])\n\t\t\t\t\t} else {\n\t\t\t\t\t\t// generate an invalid subject?\n\t\t\t\t\t\tvalues[tokenNum] = []string{\" \"}\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\treturn nil, fmt.Errorf(\"template operation in %q: %q is not defined\", list[i], op)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif !hasTags {\n\t\t\t\tsubj := list[i]\n\t\t\t\tfor idx, m := range srcs {\n\t\t\t\t\tsubj = strings.Replace(subj, m, values[idx][0], -1)\n\t\t\t\t}\n\t\t\t\tif IsValidSubject(subj) {\n\t\t\t\t\temittedList = append(emittedList, subj)\n\t\t\t\t} else if failOnBadSubject {\n\t\t\t\t\treturn nil, fmt.Errorf(\"generated invalid subject\")\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\texpCount := 1\n\t\t\t\tfor _, v := range values {\n\t\t\t\t\tif len(v) == 0 {\n\t\t\t\t\t\texpCount = 0\n\t\t\t\t\t\tbreak\n\t\t\t\t\t}\n\t\t\t\t\tif expCount > maxPermTemplateSubjectExpansions/len(v) {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\"%w: %d\", errPermTemplateExpansionLimit, maxPermTemplateSubjectExpansions)\n\t\t\t\t\t}\n\t\t\t\t\texpCount *= len(v)\n\t\t\t\t}\n\t\t\t\tif len(emittedList) > maxPermTemplateSubjectExpansions-expCount {\n\t\t\t\t\treturn nil, fmt.Errorf(\"%w: %d\", errPermTemplateExpansionLimit, maxPermTemplateSubjectExpansions)\n\t\t\t\t}\n\t\t\t\ta := nArrayCartesianProduct(values...)\n\t\t\t\tfor _, aa := range a {","sourceCodeStart":578,"sourceCodeEnd":614,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L578-L614","documentation":"After substituting template values into the permission subject, the result failed IsValidSubject; with failOnBadSubject set (server-side validation) the malformed subject is rejected rather than emitted as an unusable permission.","triggerScenarios":"Thrown at server/auth.go:596 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the subject template so all substitutions yield valid NATS subjects","Ensure tag values do not contain characters illegal in subjects (spaces, dots misplacement, wildcards in wrong position)","Validate the expanded subject strings before applying the permissions"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}