{"record":{"id":"9f13223eca5da534","repo":"pentaho/pentaho-kettle","slug":"invalid-schema-json","errorCode":null,"errorMessage":"Invalid schema JSON: ","messagePattern":"Invalid schema JSON: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"plugins/avro-format/core/src/main/java/org/pentaho/di/trans/steps/avro/AvroSchemaValidator.java","lineNumber":66,"sourceCode":"   * Validates a schema string for potential code injection vulnerabilities.\n   * \n   * @param schemaString the schema JSON string to validate\n   * @throws IllegalArgumentException if the schema contains suspicious patterns\n   */\n  public static void validateSchema(String schemaString) throws IllegalArgumentException {\n    if (schemaString == null || schemaString.isEmpty()) {\n      throw new IllegalArgumentException(\"Schema string cannot be null or empty\");\n    }\n\n    try {\n      JsonNode schemaNode = mapper.readTree(schemaString);\n      if (schemaNode.isObject()) {\n        validateSchemaNode((ObjectNode) schemaNode);\n      }\n    } catch (IllegalArgumentException e) {\n      throw e;\n    } catch (Exception e) {\n      throw new IllegalArgumentException(\"Invalid schema JSON: \" + e.getMessage(), e);\n    }\n  }\n\n  /**\n   * Validates a schema node and all its fields for injection patterns.\n   * \n   * @param node the schema node to validate\n   * @throws IllegalArgumentException if suspicious patterns are found\n   */\n  private static void validateSchemaNode(ObjectNode node) throws IllegalArgumentException {\n    Iterator<String> fieldNames = node.fieldNames();\n    \n    while (fieldNames.hasNext()) {\n      String fieldName = fieldNames.next();\n      JsonNode fieldValue = node.get(fieldName);\n\n      // Check doc field specifically, as it's the vector for CVE-2025-33042\n      if (\"doc\".equalsIgnoreCase(fieldName) && fieldValue != null) {","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/avro-format/core/src/main/java/org/pentaho/di/trans/steps/avro/AvroSchemaValidator.java#L48-L84","documentation":"AvroSchemaValidator.validateSchema parses the schema string with Jackson (mapper.readTree) and wraps any parse failure (or non-IllegalArgumentException failure) in an IllegalArgumentException prefixed with \"Invalid schema JSON: \". It means the string is not syntactically valid JSON and cannot be treated as an Avro schema.","triggerScenarios":"validateSchema is given a string that is not valid JSON — trailing commas, single quotes, unquoted keys, truncated JSON, or content like a file path or Avro IDL instead of the JSON schema.","commonSituations":"User pasted an .avsc file path instead of its contents; schema was truncated by a size limit; hand-edited JSON with syntax errors; wrong quoting when embedding the schema in a variable or properties file.","solutions":["Read the wrapped e.getMessage() after the prefix — Jackson reports the exact line/offset of the syntax error.","Validate the schema string with any JSON linter/parser and fix the syntax error.","If referencing a file, read the .avsc file's contents, not the path, before validating.","Confirm the variable/parameter substitution did not truncate or mangle the JSON."],"exampleFix":"// before\nString schema = \"/schemas/user.avsc\";\nAvroSchemaValidator.validateSchema(schema); // Invalid schema JSON: ...\n// after\nString schema = Files.readString(Path.of(\"/schemas/user.avsc\"));\nAvroSchemaValidator.validateSchema(schema);","handlingStrategy":"validation","validationCode":"public static void requireValidJson(String s) {\n  try { new com.fasterxml.jackson.databind.ObjectMapper().readTree(s); }\n  catch (Exception e) { throw new IllegalArgumentException(\"Not valid JSON: \" + e.getMessage()); }\n}","typeGuard":null,"tryCatchPattern":"try {\n  AvroSchemaValidator.validateSchema(schemaString);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().startsWith(\"Invalid schema JSON:\")) {\n    logger.error(\"Fix JSON syntax: \" + e.getMessage());\n  }\n  throw e;\n}","preventionTips":["Validate schema JSON with a linter before pasting into step config.","Pass file contents, not file paths, when a schema file is referenced.","Avoid hand-editing JSON; generate schemas from tooling where possible."],"tags":["avro","json","schema","validation"],"backgroundTag":"json-parse-error","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}