{"record":{"id":"7104ed8680201656","repo":"puppetlabs/puppet","slug":"invalid-sid","errorCode":null,"errorMessage":"Invalid SID","messagePattern":"Invalid SID","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/security.rb","lineNumber":436,"sourceCode":"      perms_to_strip = ~(FILE::FILE_EXECUTE + FILE::WRITE_OWNER + FILE::WRITE_DAC)\n      dacl.allow(Puppet::Util::Windows::SID::CreatorOwner, owner_allow & perms_to_strip, inherit)\n      dacl.allow(Puppet::Util::Windows::SID::CreatorGroup, group_allow & perms_to_strip, inherit)\n    end\n\n    new_sd = Puppet::Util::Windows::SecurityDescriptor.new(sd.owner, sd.group, dacl, protected)\n    set_security_descriptor(path, new_sd)\n\n    nil\n  end\n\n  ACL_REVISION = 2\n\n  def add_access_allowed_ace(acl, mask, sid, inherit = nil)\n    inherit ||= NO_INHERITANCE\n\n    Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|\n      if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end\n\n      if AddAccessAllowedAceEx(acl, ACL_REVISION, inherit, mask, sid_ptr) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Failed to add access control entry\")\n      end\n    end\n\n    # ensure this method is void if it doesn't raise\n    nil\n  end\n\n  def add_access_denied_ace(acl, mask, sid, inherit = nil)\n    inherit ||= NO_INHERITANCE\n\n    Puppet::Util::Windows::SID.string_to_sid_ptr(sid) do |sid_ptr|\n      if Puppet::Util::Windows::SID.IsValidSid(sid_ptr) == FFI::WIN32_FALSE\n        raise Puppet::Util::Windows::Error, _(\"Invalid SID\")\n      end","sourceCodeStart":418,"sourceCodeEnd":454,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/security.rb#L418-L454","documentation":"Raised by Security.add_access_allowed_ace (lib/puppet/util/windows/security.rb:436) when the SID pointer produced by SID.string_to_sid_ptr fails IsValidSid — the sid argument converted to a pointer but is not structurally a SID: malformed S-D-S-I-R string (wrong revision/authority, truncated subauthority list), or garbage input that happened to convert.","triggerScenarios":"Passing a truncated or typo'd SID string like 'S-1-5-32-54' (missing final RID) or 'S-1-5-32-545x'; SIDs assembled by string manipulation from unvalidated input; an empty or garbage string after an upstream resolution failure.","commonSituations":"Hardcoded SIDs in manifests or ACL templates with typos; SIDs copied from whoami output losing a component; SID columns imported from databases or CSVs with truncation.","solutions":["Validate the shape first: /^S-1-(\\d+-){1,14}\\d+$/ catches most bad data cheaply.","Resolve account names at runtime via SID.name_to_principal(name).sid instead of hand-building SID strings.","For builtin accounts, use Puppet's well-known SID constants (Puppet::Util::Windows::SID::BuiltinAdministrators, ::BuiltinUsers, etc.).","Rescue and reject the ACE early with a log that includes the offending sid value."],"exampleFix":"# before — typo'd/truncated SID\nadd_access_allowed_ace(acl, mask, 'S-1-5-32-54')\n\n# after — resolve the account and use its SID string\nsid = Puppet::Util::Windows::SID.name_to_principal('BUILTIN\\Users')&.sid\nadd_access_allowed_ace(acl, mask, sid) if sid","handlingStrategy":"validation","validationCode":"SID_PATTERN = /^S-1-(?:\\d+-){1,14}\\d+$/.freeze\nraise ArgumentError, \"malformed SID: #{sid.inspect}\" unless sid.is_a?(String) && sid.match?(SID_PATTERN)\nadd_access_allowed_ace(acl, mask, sid)","typeGuard":"sid_string? = ->(s) { s.is_a?(String) && s.match?(/^S-1-(?:\\d+-){1,14}\\d+$/) }","tryCatchPattern":null,"preventionTips":["Resolve names to SIDs at runtime instead of hardcoding SID strings","Validate SID strings at the data boundary (manifest parse, CSV import)","Use Puppet's well-known SID constants for builtin accounts"],"tags":["windows","sid","acl","validation","puppet"],"backgroundTag":"invalid-sid-string","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}