{"record":{"id":"96e2ba35acaabced","repo":"astrid-runtime/astrid","slug":"invalid-fuse-callback-token","errorCode":null,"errorMessage":"invalid FUSE callback token","messagePattern":"invalid FUSE callback token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fuse/src/service.rs","lineNumber":209,"sourceCode":"    }\n    if let Some(identity) = parent.start_identity.as_deref()\n        && (identity.is_empty() || identity.len() > 512 || identity.chars().any(char::is_control))\n    {\n        bail!(\"invalid FUSE service parent start identity\");\n    }\n    #[cfg(target_os = \"linux\")]\n    if parent.start_identity.is_none() {\n        bail!(\"FUSE service parent start identity is required on Linux\");\n    }\n    Ok(())\n}\n\nfn validate_lease(lease: &StorageMountLeaseV1) -> Result<()> {\n    if lease.lease_token.len() < 16\n        || lease.lease_token.len() > 4096\n        || lease.lease_token.chars().any(char::is_control)\n    {\n        bail!(\"invalid FUSE callback token\");\n    }\n    let now = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .context(\"read system clock\")?\n        .as_secs();\n    if lease.expires_at_epoch_secs < now {\n        bail!(\"FUSE lease is expired\");\n    }\n    if !lease.resource_path.is_absolute() || !lease.callback_path.is_absolute() {\n        bail!(\"FUSE lease paths must be absolute\");\n    }\n    if lease.callback_path != lease.resource_path.join(\"control.sock\") {\n        bail!(\"FUSE callback path is not the kernel lease endpoint\");\n    }\n    platform_fs::validate_private_directory(&lease.resource_path)\n        .context(\"validate private FUSE lease resource\")?;\n    platform_fs::verify_no_redirects(&lease.resource_path)\n        .context(\"reject redirected FUSE lease resource\")?;","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fuse/src/service.rs#L191-L227","documentation":"The mount lease's `lease_token` doubles as the callback authentication token and must be 16–4096 bytes with no control characters. A token that is absent, too short/long, or contains control characters is rejected before the FUSE service accepts the lease.","triggerScenarios":"`validate_lease` (called from `validate_launch`) finds `lease.lease_token.len() < 16 || > 4096 || contains control chars`.","commonSituations":"Lease issued by an older/buggy broker with a short token; token read from a file with trailing newline; truncated token in a serialized lease; hand-crafted lease JSON in tests.","solutions":["Regenerate the lease so `lease_token` is a fresh CSPRNG value of ≥16 bytes.","Strip control characters (trim whitespace/newlines) when loading the token from storage or env.","Check the lease broker/issuer version and fix token generation at the source.","Validate the token length before writing lease.json so bad leases never reach the helper."],"exampleFix":"// before\nlease_token: short_id(), // e.g. 8 chars\n// after\nlease_token: generate_token(32), // 32 random bytes, hex-encoded, trimmed","handlingStrategy":"validation","validationCode":"fn valid_lease_token(t: &str) -> bool {\n    (16..=4096).contains(&t.len()) && !t.chars().any(char::is_control)\n}","typeGuard":"fn has_valid_lease_token(lease: &StorageMountLeaseV1) -> bool {\n    (16..=4096).contains(&lease.lease_token.len()) && !lease.lease_token.chars().any(char::is_control)\n}","tryCatchPattern":null,"preventionTips":["Issue lease tokens of 16+ random bytes","Trim tokens loaded from files/env","Validate leases at creation, not only at mount time"],"tags":["fuse","validation","security","token"],"backgroundTag":"invalid-argument-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}