{"record":{"id":"91961788e4cf58b4","repo":"apache/pulsar","slug":"invalid-key-format","errorCode":null,"errorMessage":"Invalid key format","messagePattern":"Invalid key format","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/DefaultCryptoKeyReader.java","lineNumber":104,"sourceCode":"\n        return keyInfo;\n    }\n\n    private byte[] loadKey(String keyUrl) throws IOException, IllegalAccessException, InstantiationException {\n        try {\n            URLConnection urlConnection = new URL(keyUrl).openConnection();\n            try {\n                String protocol = urlConnection.getURL().getProtocol();\n                if (\"data\".equals(protocol) && !APPLICATION_X_PEM_FILE.equals(urlConnection.getContentType())) {\n                    throw new IllegalArgumentException(\n                            \"Unsupported media type or encoding format: \" + urlConnection.getContentType());\n                }\n                return IOUtils.toByteArray(urlConnection);\n            } finally {\n                IOUtils.close(urlConnection);\n            }\n        } catch (URISyntaxException e) {\n            throw new IllegalArgumentException(\"Invalid key format\");\n        }\n    }\n\n}\n","sourceCodeStart":86,"sourceCodeEnd":109,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/DefaultCryptoKeyReader.java#L86-L109","documentation":"loadKey() parses the given key URL, and a URISyntaxException means the string is not a valid URI at all (illegal characters, spaces, malformed scheme). The reader converts this into a clearer IllegalArgumentException('Invalid key format') so callers get an actionable message instead of a raw URI exception.","triggerScenarios":"Passing a malformed key URL string to DefaultCryptoKeyReader (constructor with keyReader public/private key URLs) that getPublicKey/getPrivateKey then try to load — e.g. a path with spaces or unescaped special characters like '{' '}' '|'.","commonSituations":"Pasting file paths with spaces without encoding; template placeholders like ${KEY_URL} never substituted; keys built by string concatenation without URI encoding.","solutions":["URL-encode the key URL (URLEncoder.encode for components or URI-based escaping) before passing it.","Fix the key URL string: replace spaces and illegal characters with percent-encoded equivalents.","If referencing a local file, use a properly encoded file:///abs/path URI or the file-path constructor variant."],"exampleFix":"// before\nnew DefaultCryptoKeyReader(\"file:///keys/my key.pem\", \"file:///keys/priv.pem\");\n// after\nnew DefaultCryptoKeyReader(\"file:///keys/my%20key.pem\", \"file:///keys/priv.pem\");","handlingStrategy":"validation","validationCode":"try { new URI(keyUrl); } catch (URISyntaxException e) {\n  throw new IllegalArgumentException(\"Malformed key URL: \" + keyUrl, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  reader.getPrivateKey(keyName);\n} catch (IllegalArgumentException e) {\n  // invalid key format: URL-encode and retry\n}","preventionTips":["URL-encode any variable-derived key URL component.","Reject key URL strings containing spaces or template placeholders at config load time.","Test key URL resolution in a startup smoke check."],"tags":["pulsar","encryption","uri","configuration"],"backgroundTag":"invalid-key-url","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}