{"record":{"id":"68df49b98e3ee744","repo":"apache/hadoop","slug":"invalid-aclspec","errorCode":null,"errorMessage":"Invalid <aclSpec> : ","messagePattern":"Invalid <aclSpec> : ","errorType":"validation","errorClass":"HadoopIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/permission/AclEntry.java","lineNumber":271,"sourceCode":"   *          String representation of an ACL.<br>\n   *          Example: \"user:foo:rw-\"\n   * @param includePermission\n   *          for setAcl operations this will be true. i.e. Acl should include\n   *          permissions.<br>\n   *          But for removeAcl operation it will be false. i.e. Acl should not\n   *          contain permissions.<br>\n   *          Example: \"user:foo,group:bar,mask::\"\n   * @return Returns an {@link AclEntry} object\n   */\n  public static AclEntry parseAclEntry(String aclStr,\n      boolean includePermission) {\n    AclEntry.Builder builder = new AclEntry.Builder();\n    // Here \"::\" represent one empty string.\n    // StringUtils.getStringCollection() will ignore this.\n    String[] split = aclStr.split(\":\");\n\n    if (split.length == 0) {\n      throw new HadoopIllegalArgumentException(\"Invalid <aclSpec> : \" + aclStr);\n    }\n    int index = 0;\n    if (\"default\".equals(split[0])) {\n      // default entry\n      index++;\n      builder.setScope(AclEntryScope.DEFAULT);\n    }\n\n    if (split.length <= index) {\n      throw new HadoopIllegalArgumentException(\"Invalid <aclSpec> : \" + aclStr);\n    }\n\n    AclEntryType aclType = null;\n    try {\n      aclType = Enum.valueOf(\n          AclEntryType.class, StringUtils.toUpperCase(split[index]));\n      builder.setType(aclType);\n      index++;","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/permission/AclEntry.java#L253-L289","documentation":"AclEntry.parseAclEntry(aclStr, includePermission) splits the ACL spec on ':' and validates the token layout of Hadoop ACL entries (e.g. user:foo:rwx, group::r-x, default:user:foo:---). The first guard throws HadoopIllegalArgumentException(\"Invalid <aclSpec> : ...\") when the split yields no usable tokens — effectively an empty or separator-only spec with no type field at all.","triggerScenarios":"Passing an empty string or a spec made only of separators such as \":\"; programmatically assembled specs that collapse to empty after filtering (e.g. joining an empty list with ':').","commonSituations":"Shell/CLI wrappers forwarding unset variables (hdfs dfs -setfacl -m \"${ACL}\" with ACL empty); config-driven ACL templates where variable substitution produced an empty string; list-handling bugs joining zero entries into a spec.","solutions":["Validate the spec is non-empty and shape-correct before calling parseAclEntry","Fix the upstream variable/substitution so an empty ACL never reaches the parser","When generating entries in code, prefer the AclEntry.Builder API over string parsing"],"exampleFix":"// before\nAclEntry e = AclEntry.parseAclEntry(aclSpec, true);   // aclSpec == \"\" -> HadoopIllegalArgumentException\n\n// after\nif (aclSpec == null || aclSpec.trim().isEmpty()) {\n  throw new IllegalArgumentException(\"aclSpec must not be empty\");\n}\nAclEntry e = AclEntry.parseAclEntry(aclSpec, true);","handlingStrategy":"validation","validationCode":"private static final Pattern ACL_ENTRY =\n    Pattern.compile(\"^(default:)?(user|group|mask|other)(:[^:]*)?(:[rwx-]{1,3})?$\",\n        Pattern.CASE_INSENSITIVE);\n\nif (aclSpec == null || !ACL_ENTRY.matcher(aclSpec).matches()) {\n  throw new IllegalArgumentException(\"malformed aclSpec: \" + aclSpec);\n}\nAclEntry e = AclEntry.parseAclEntry(aclSpec, includePermission);","typeGuard":null,"tryCatchPattern":"catch HadoopIllegalArgumentException from parseAclEntry and surface it to the user/config author with the exact spec and expected format; do not retry the same string.","preventionTips":["Reject empty/blank ACL strings at the config/CLI boundary","Prefer AclEntry.Builder over string parsing in generated code","Add unit tests for the parser boundary with malformed specs"],"tags":["hadoop","acl","validation","parsing"],"backgroundTag":"acl-spec-validation-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}