{"record":{"id":"8417b9ccf98ee9cf","repo":"apache/pulsar","slug":"unsupported-media-type-or-encoding-format-conte","errorCode":null,"errorMessage":"Unsupported media type or encoding format: ${contentType}","messagePattern":"Unsupported media type or encoding format: (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/DefaultCryptoKeyReader.java","lineNumber":96,"sourceCode":"            log.warn().attr(\"keyName\", keyName).log(\"Private key is not set\");\n        } else {\n            try {\n                keyInfo.setKey(loadKey(privateKey));\n            } catch (Exception e) {\n                log.error().attr(\"keyName\", keyName).exception(e).log(\"Failed to load private key\");\n            }\n        }\n\n        return keyInfo;\n    }\n\n    private byte[] loadKey(String keyUrl) throws IOException, IllegalAccessException, InstantiationException {\n        try {\n            URLConnection urlConnection = new URL(keyUrl).openConnection();\n            try {\n                String protocol = urlConnection.getURL().getProtocol();\n                if (\"data\".equals(protocol) && !APPLICATION_X_PEM_FILE.equals(urlConnection.getContentType())) {\n                    throw new IllegalArgumentException(\n                            \"Unsupported media type or encoding format: \" + urlConnection.getContentType());\n                }\n                return IOUtils.toByteArray(urlConnection);\n            } finally {\n                IOUtils.close(urlConnection);\n            }\n        } catch (URISyntaxException e) {\n            throw new IllegalArgumentException(\"Invalid key format\");\n        }\n    }\n\n}\n","sourceCodeStart":78,"sourceCodeEnd":109,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/DefaultCryptoKeyReader.java#L78-L109","documentation":"DefaultCryptoKeyReader.loadKey() reads encryption keys via URL. For data: URIs the content must be a PEM-encoded key (application/x-pem-file); any other media type or encoding is rejected with IllegalArgumentException so a wrong-format key is never silently used for encryption.","triggerScenarios":"Passing a key URL with a data: scheme whose content type is not application/x-pem-file — e.g. data:application/octet-stream;base64,... or a missing/wrong MIME parameter — via ReaderConfig keyReader with getPublicKey/getPrivateKey resolving that URL.","commonSituations":"Hand-built data: URIs missing the ;base64 parameter or using the wrong MIME type; keys generated by tools that emit DER instead of PEM; misconfigured key URLs in producer encryption configs.","solutions":["Use data:application/x-pem-file;base64,<base64-encoded-PEM> as the key URL.","Convert the key to PEM format (e.g. openssl rsa -inform DER -outform PEM) and re-encode.","Serve keys over file: or http(s): URLs instead of data: URIs."],"exampleFix":"// before\nString keyUrl = \"data:application/octet-stream;base64,\" + b64(pemBytes);\n// after\nString keyUrl = \"data:application/x-pem-file;base64,\" + b64(pemBytes);","handlingStrategy":"validation","validationCode":"String url = keyUrl;\nif (url.startsWith(\"data:\")) {\n  String meta = url.substring(5, url.indexOf(','));\n  if (!meta.contains(\"application/x-pem-file\")) {\n    throw new IllegalArgumentException(\"data URI must be application/x-pem-file\");\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  reader.getPublicKey(keyName);\n} catch (IllegalArgumentException e) {\n  // unsupported media type: fix data URI MIME type to application/x-pem-file\n}","preventionTips":["Always emit PEM-encoded keys with MIME application/x-pem-file in data URIs.","Validate key URLs at startup with a probe load before configuring encryption.","Prefer file:// or https:// key URLs served with correct Content-Type."],"tags":["pulsar","encryption","crypto-key-reader","configuration"],"backgroundTag":"unsupported-media-type","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}