{"record":{"id":"74a0ea7638fc4a40","repo":"apache/seatunnel","slug":"server-property-must-contain-at-least-one-absol","errorCode":null,"errorMessage":"Server property {} must contain at least one absolute executable path","messagePattern":"Server property (.+?) must contain at least one absolute executable path","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"seatunnel-connectors-v2/connector-python/src/main/java/org/apache/seatunnel/connectors/seatunnel/python/source/PythonSourceExecutionPolicy.java","lineNumber":76,"sourceCode":"    }\n\n    private static void ensureEnabled() {\n        if (Boolean.parseBoolean(\n                System.getProperty(PYTHON_SOURCE_ENABLED_PROPERTY, Boolean.FALSE.toString()))) {\n            return;\n        }\n        throw new IllegalStateException(\n                \"Python source is disabled by the server-side security policy. Set -D\"\n                        + PYTHON_SOURCE_ENABLED_PROPERTY\n                        + \"=true and configure -D\"\n                        + PYTHON_ALLOWED_EXECUTABLES_PROPERTY\n                        + \" with absolute interpreter paths on every worker node.\");\n    }\n\n    private static List<Path> parseAllowedExecutables() {\n        String rawAllowlist = System.getProperty(PYTHON_ALLOWED_EXECUTABLES_PROPERTY, \"\");\n        if (rawAllowlist.trim().isEmpty()) {\n            throw new IllegalStateException(\n                    \"Server property \"\n                            + PYTHON_ALLOWED_EXECUTABLES_PROPERTY\n                            + \" must contain at least one absolute executable path\");\n        }\n        Set<Path> allowedExecutables = new LinkedHashSet<>();\n        for (String rawEntry : rawAllowlist.split(\",\")) {\n            String entry = rawEntry.trim();\n            if (entry.isEmpty()) {\n                continue;\n            }\n            Path path = Paths.get(entry);\n            if (!path.isAbsolute()) {\n                throw new IllegalStateException(\n                        \"Python source allowlist entry must be an absolute path: \" + entry);\n            }\n            allowedExecutables.add(normalize(path));\n        }\n        if (allowedExecutables.isEmpty()) {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-python/src/main/java/org/apache/seatunnel/connectors/seatunnel/python/source/PythonSourceExecutionPolicy.java#L58-L94","documentation":"Thrown when the SeaTunnel Python source is used but the JVM system property 'python.allowed.executables' (PYTHON_ALLOWED_EXECUTABLES_PROPERTY) is unset or blank. This security allowlist of absolute Python interpreter paths is mandatory so workers never execute an arbitrary interpreter. The property must contain at least one absolute path before the source can run.","triggerScenarios":"Calling PythonSourceExecutionPolicy.allowedExecutables() (indirectly via source open) when System.getProperty for the allowlist returns empty/whitespace, e.g. the property was never set via -Dpython.allowed.executables=...","commonSituations":"Deploying a Zeta worker or running a batch job without the -D flag in JVM options; copying config from docs that omit the property; running unit tests without the system property set.","solutions":["Set the JVM system property, e.g. -Dpython.allowed.executables=/usr/bin/python3,/opt/venv/bin/python","Verify with: java -XshowSettings:properties -version 2>&1 | grep python.allowed","If running via seatunnel.sh, add the property to JVM options in the worker startup config"],"exampleFix":"// before\njava -jar seatunnel-starter.jar\n// after\njava -Dpython.allowed.executables=/usr/bin/python3 -jar seatunnel-starter.jar","handlingStrategy":"validation","validationCode":"String v = System.getProperty(\"python.allowed.executables\", \"\");\nif (v.trim().isEmpty()) throw new IllegalStateException(\"Set -Dpython.allowed.executables=/abs/path/python3 before starting SeaTunnel\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add the -D property to worker JVM options in deployment templates","Startup-check the property in smoke tests","Document the required property in cluster provisioning scripts"],"tags":["python","configuration","security","startup"],"backgroundTag":"missing-env-var","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}