{"record":{"id":"9cea4554d72bf5a1","repo":"quarkusio/quarkus","slug":"spiffe-id-path-contains-invalid-character-c","errorCode":null,"errorMessage":"SPIFFE ID path contains invalid character '' + c + '': ","messagePattern":"SPIFFE ID path contains invalid character '' \\+ c \\+ '': ","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":139,"sourceCode":"        }\n        if (path.endsWith(\"/\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID path must not have a trailing slash: \" + spiffeId);\n        }\n        String[] segments = path.split(\"/\", -1);\n        for (int i = 1; i < segments.length; i++) {\n            String segment = segments[i];\n            if (segment.isEmpty()) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID path must not contain empty segments: \" + spiffeId);\n            }\n            if (\".\".equals(segment) || \"..\".equals(segment)) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID path must not contain dot segments: \" + spiffeId);\n            }\n            for (int j = 0; j < segment.length(); j++) {\n                char c = segment.charAt(j);\n                if (!isValidPathChar(c)) {\n                    throw new SpiffeConnectionException(\n                            \"SPIFFE ID path contains invalid character '\" + c + \"': \" + spiffeId);\n                }\n            }\n        }\n    }\n\n    private static String extractOptionalUriSan(X509Certificate cert) {\n        try {\n            var sans = cert.getSubjectAlternativeNames();\n            if (sans == null) {\n                return null;\n            }\n            for (var san : sans) {\n                if (san.size() > 1 && san.get(0) instanceof Integer type && type == URI_SAN_TYPE\n                        && san.get(1) != null) {\n                    return san.get(1).toString();\n                }\n            }","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L121-L157","documentation":"A SPIFFE ID path segment contains a character outside the allowed SPIFFE path character set (validated by isValidPathChar). The SPIFFE standard restricts paths to specific ASCII characters so IDs remain portable and unambiguous across systems. The validator rejects the ID before it is used for workload identity decisions.","triggerScenarios":"Calling SpiffeValidator.validateSpiffeId with a SPIFFE ID (from a URI SAN of a workload certificate) whose path segments contain characters like spaces, unicode, '%', or other non-allowed ASCII characters.","commonSituations":"A workload certificate issued by a non-compliant SPIFFE CA includes malformed URI SANs; URL-encoded or human-readable paths injected into identity strings; manually constructed spiffe:// IDs containing typos or special characters.","solutions":["Regenerate the workload certificate so its SPIFFE ID path uses only valid path characters (letters, digits, and standard path punctuation per the SPIFFE spec).","Fix the CA/identity-issuance configuration that produces malformed path segments.","Log and inspect the offending SPIFFE ID from the certificate URI SAN to identify the exact invalid character and its source."],"exampleFix":"// before (CA emits encoded path)\n//   spiffe://trust/ns/prod%20cluster/sa/app\n// after (valid segment characters)\n//   spiffe://trust/ns/prod-cluster/sa/app","handlingStrategy":"validation","validationCode":"boolean hasValidSpiffePath(String spiffeId) {\n    int idx = spiffeId.indexOf(\"://\");\n    if (idx < 0) return false;\n    String path = spiffeId.substring(spiffeId.indexOf('/', idx + 3));\n    for (String seg : path.split(\"/\")) {\n        for (char c : seg.toCharArray()) {\n            if (!(Character.isLetterOrDigit(c) || c == '.' || c == '-' || c == '_')) return false;\n        }\n    }\n    return true;\n}","typeGuard":null,"tryCatchPattern":"try {\n    validator.validateSpiffeId(id);\n} catch (SpiffeConnectionException e) {\n    log.errorf(\"Invalid SPIFFE ID %s: %s\", id, e.getMessage());\n}","preventionTips":["Sanitize identity strings before embedding them in certificate SANs at the CA.","Reject non-ASCII characters in workload identity names at issuance time.","Test SVID generation with edge-case workload names (spaces, unicode, encoding)."],"tags":["spiffe","certificate","validation","identity"],"backgroundTag":"invalid-spiffe-id-path","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}