{"record":{"id":"8e199381d1ec9ee4","repo":"apache/hadoop","slug":"the-value-of-the-aclspec-parameter-is-invalid","errorCode":null,"errorMessage":"The value of the aclSpec parameter is invalid.","messagePattern":"The value of the aclSpec parameter is invalid\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java","lineNumber":1265,"sourceCode":"   * @param aclSpec List of AbfsAclEntry describing modifications\n   * @throws IOException if an ACL could not be modified\n   */\n  @Override\n  public void modifyAclEntries(final Path path, final List<AclEntry> aclSpec)\n      throws IOException {\n    LOG.debug(\"AzureBlobFileSystem.modifyAclEntries path: {}\", path);\n    TracingContext tracingContext = new TracingContext(clientCorrelationId,\n        fileSystemId, FSOperationType.MODIFY_ACL, true, tracingHeaderFormat,\n        listener);\n\n    if (!getIsNamespaceEnabled(tracingContext)) {\n      throw new UnsupportedOperationException(\n          \"modifyAclEntries is only supported by storage accounts with the \"\n              + \"hierarchical namespace enabled.\");\n    }\n\n    if (aclSpec == null || aclSpec.isEmpty()) {\n      throw new IllegalArgumentException(\"The value of the aclSpec parameter is invalid.\");\n    }\n\n    Path qualifiedPath = makeQualified(path);\n\n    try {\n      getAbfsStore().modifyAclEntries(qualifiedPath, aclSpec, tracingContext);\n    } catch (AzureBlobFileSystemException ex) {\n      checkException(path, ex);\n    }\n  }\n\n  /**\n   * Removes ACL entries from files and directories.  Other ACL entries are\n   * retained.\n   *\n   * @param path    Path to modify\n   * @param aclSpec List of AclEntry describing entries to remove\n   * @throws IOException if an ACL could not be modified","sourceCodeStart":1247,"sourceCodeEnd":1283,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystem.java#L1247-L1283","documentation":"Thrown by AzureBlobFileSystem.modifyAclEntries when the aclSpec list is null or empty, after the HNS check passes. Merging an empty set of entries is meaningless, so the driver rejects it before contacting the service. It signals a caller bug, not a service or permission problem.","triggerScenarios":"Calling fs.modifyAclEntries(path, null) or fs.modifyAclEntries(path, Collections.emptyList()) on an HNS-enabled account.","commonSituations":"AclEntry.parseAclSpec output filtered down to nothing on malformed input; ACL-diff logic computing an empty change set and calling modify anyway; defaulting a missing config to null.","solutions":["Skip the call when the list is null or empty.","Inspect how the list was built (parse/filter steps) and fix the empty result.","Validate the spec string before parsing with AclEntry.parseAclSpec."],"exampleFix":"// before\nfs.modifyAclEntries(path, entries);\n\n// after\nif (entries != null && !entries.isEmpty()) {\n  fs.modifyAclEntries(path, entries);\n}","handlingStrategy":"validation","validationCode":"if (aclSpec == null || aclSpec.isEmpty()) {\n  return; // nothing to modify\n}\nfs.modifyAclEntries(path, aclSpec);","typeGuard":"static boolean isNonEmpty(List<AclEntry> l) {\n  return l != null && !l.isEmpty();\n}","tryCatchPattern":"try {\n  fs.modifyAclEntries(path, aclSpec);\n} catch (IllegalArgumentException e) {\n  // empty/null spec: fix the entry producer, do not retry\n}","preventionTips":["Check list size after parse/filter steps, before the FS call.","Log the computed entry count when debugging ACL pipelines.","Share one guard across modify/remove/set ACL entry calls."],"tags":["azure-abfs","acl","illegal-argument","modifyaclentries"],"backgroundTag":"missing-required-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}