{"record":{"id":"8603f0e71f5c7158","repo":"SonarSource/sonarqube","slug":"provided-json-is-invalid","errorCode":null,"errorMessage":"Provided JSON is invalid","messagePattern":"Provided JSON is invalid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/setting/ws/SettingValidations.java","lineNumber":203,"sourceCode":"        });\n    }\n\n    private void validateLogin(SettingData data) {\n      try (DbSession dbSession = dbClient.openSession(false)) {\n        List<UserDto> users = dbClient.userDao().selectByLogins(dbSession, data.values).stream().filter(UserDto::isActive).toList();\n        checkRequest(data.values.size() == users.size(), \"Error when validating login setting with key '%s' and values [%s]. A value is not a valid login.\",\n          data.key, String.join(\", \", data.values));\n      }\n    }\n\n    private void validateJson(SettingData data, PropertyDefinition definition) {\n      Optional<String> jsonContent = data.values.stream().findFirst();\n      if (jsonContent.isPresent()) {\n        try {\n          new Gson().getAdapter(JsonElement.class).fromJson(jsonContent.get());\n          validateJsonSchema(jsonContent.get(), definition);\n        } catch (JsonParseException | IOException e) {\n          throw new IllegalArgumentException(\"Provided JSON is invalid\");\n        }\n      }\n    }\n\n    private void validateJsonSchema(String json, PropertyDefinition definition) {\n      if (SECURITY_JSON_PROPERTIES.contains(definition.key())) {\n        JsonValue jsonToValidate = new JsonParser(json).parse();\n        Optional.ofNullable(schemaValidator.validate(jsonToValidate))\n          .ifPresent(validationFailure -> {\n            ValidationFailure rootCause = getRootCause(validationFailure);\n            throw new IllegalArgumentException(String.format(\"Provided JSON is invalid : [%s at %s]\", rootCause.getMessage(), rootCause.getInstance().getLocation()));\n          });\n      }\n    }\n\n    private static ValidationFailure getRootCause(ValidationFailure base) {\n      return base.getCauses().stream()\n        .map(ValueTypeValidation::getRootCause)","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/setting/ws/SettingValidations.java#L185-L221","documentation":"SettingValidations.validateJson parses the submitted value as JSON with Gson before storing a JSON-typed setting. If Gson raises JsonParseException (or reading the content fails with IOException), the value is not valid JSON and IllegalArgumentException(\"Provided JSON is invalid\") is thrown, surfaced as a 400 from the web API.","triggerScenarios":"POST api/settings/set on a JSON-typed setting (definition.type == JSON) where the value string is malformed, e.g. missing quotes, trailing comma, single quotes, or truncated payload.","commonSituations":"Copy-pasting JSON with smart quotes from docs, shell quoting stripping double quotes, truncation when the value is passed via form-encoded parameters, or templating engines mangling braces.","solutions":["Validate the JSON with a parser before sending (JSON.parse / jq) and fix syntax errors","Send the value properly form-encoded so quotes survive transport","If it is a SECURITY_JSON_PROPERTIES key, additionally confirm the payload matches the setting's JSON schema"],"exampleFix":"// before\ncurl -d 'key=sonar.xxx' -d 'value={a:1}' ...   # not valid JSON\n// after\ncurl -d 'key=sonar.xxx' --data-urlencode 'value={\"a\":1}' ...","handlingStrategy":"validation","validationCode":"function isValidJson(s) { try { JSON.parse(s); return true; } catch { return false; } }\nif (!isValidJson(value)) throw new Error('Fix JSON before calling api/settings/set');","typeGuard":"function asJsonObject(s) { try { return { ok: true, value: JSON.parse(s) }; } catch { return { ok: false }; } }","tryCatchPattern":"try { await setSetting(key, json); } catch (e) { if (/Provided JSON is invalid$/.test(e.message)) { console.error('Payload is not parseable JSON'); } throw e; }","preventionTips":["Run the payload through JSON.parse or jq before sending","Always use --data-urlencode or a JSON body so quotes survive shell/HTTP encoding","Avoid hand-writing JSON in shell scripts; generate it with a serializer"],"tags":["json","validation","settings","api"],"backgroundTag":"json-parse-error","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}