{"record":{"id":"9268aa4d03d58e30","repo":"quarkusio/quarkus","slug":"invalid-escape-sequence-in-permission-value-raw","errorCode":null,"errorMessage":"Invalid escape sequence in permission value '${raw}': backslash is only allowed before a colon (\\:)","messagePattern":"Invalid escape sequence in permission value '(.+?)': backslash is only allowed before a colon \\(\\\\:\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/PermissionToActionUtil.java","lineNumber":35,"sourceCode":"\n    private PermissionToActionUtil() {\n    }\n\n    public static ParsedPermission parse(String raw) {\n        if (raw.isEmpty()) {\n            throw new IllegalArgumentException(\"Permission value must not be empty\");\n        }\n\n        var name = new StringBuilder();\n        var action = new StringBuilder();\n        boolean foundSeparator = false;\n        char[] chars = raw.toCharArray();\n\n        for (int i = 0; i < chars.length; i++) {\n            switch (chars[i]) {\n                case '\\\\':\n                    if (++i == chars.length || chars[i] != ':') {\n                        throw new IllegalArgumentException(\n                                \"Invalid escape sequence in permission value '\" + raw\n                                        + \"': backslash is only allowed before a colon (\\\\:)\");\n                    }\n                    if (foundSeparator) {\n                        action.append(':');\n                    } else {\n                        name.append(':');\n                    }\n                    break;\n                case ':':\n                    if (foundSeparator) {\n                        throw new IllegalArgumentException(\n                                \"Permission value '\" + raw\n                                        + \"' contains more than one unescaped colon separator, use \\\\: for a literal colon\");\n                    }\n                    foundSeparator = true;\n                    break;\n                default:","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/PermissionToActionUtil.java#L17-L53","documentation":"In the permission config value 'PermissionClass:action', a backslash is only meaningful as an escape for a literal colon ('\\:'). Any other use of backslash makes parsing ambiguous, so parse() throws IllegalArgumentException.","triggerScenarios":"A permission config value containing a backslash not immediately followed by a colon, e.g. 'com.app.My\\Permission:read' or a value ending with a trailing backslash.","commonSituations":"Windows-style paths or regex fragments pasted into permission config; attempting to escape other characters like '=' or '.' with backslash; generated config where a value containing backslashes was not re-escaped.","solutions":["Remove the stray backslash or replace it with the intended literal character.","Escape only literal colons as '\\:' in the permission value.","If a real backslash character is needed in the name, it is not supported by this parser; encode the value differently."],"exampleFix":"# before\nperm=com.example.My\\Permission:read\n\n# after\nperm=com.example.MyPermission:read","handlingStrategy":"validation","validationCode":"boolean validEscapes(String raw) {\n    for (int i = 0; i < raw.length(); i++) {\n        if (raw.charAt(i) == '\\\\' && (i + 1 >= raw.length() || raw.charAt(i + 1) != ':')) return false;\n    }\n    return true;\n}","typeGuard":null,"tryCatchPattern":"try { PermissionToActionUtil.parse(raw); } catch (IllegalArgumentException e) { /* only \\\\ is allowed */ }","preventionTips":["Only use backslash to escape colons","Don't paste Windows paths or regexes into permission values","Escape literal colons in class names"],"tags":["security","configuration","permissions","escaping"],"backgroundTag":"security-permission-config-invalid","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}