{"record":{"id":"a2c8fcaec31d1fa4","repo":"vectordotdev/vector","slug":"password-must-be-valid-utf-8","errorCode":null,"errorMessage":"Password must be valid UTF-8.","messagePattern":"Password must be valid UTF-8\\.","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/vector-core/src/config/proxy.rs","lineNumber":169,"sourceCode":"    }\n\n    fn build_proxy(\n        &self,\n        proxy_scheme: &'static str,\n        proxy_url: Option<&String>,\n    ) -> Result<Option<Proxy>, InvalidUri> {\n        proxy_url\n            .as_ref()\n            .map(|url| {\n                url.parse().map(|parsed| {\n                    let mut proxy = Proxy::new(self.interceptor().intercept(proxy_scheme), parsed);\n                    if let Ok(authority) = Url::parse(url)\n                        && let Some(password) = authority.password()\n                    {\n                        let decoded_user = urlencoding::decode(authority.username())\n                            .expect(\"username must be valid UTF-8.\");\n                        let decoded_pw =\n                            urlencoding::decode(password).expect(\"Password must be valid UTF-8.\");\n                        let mut authorization =\n                            Authorization::basic(&decoded_user, &decoded_pw).0.encode();\n                        authorization.set_sensitive(true);\n                        proxy.set_header(PROXY_AUTHORIZATION, authorization);\n                    }\n                    proxy\n                })\n            })\n            .transpose()\n    }\n\n    fn http_proxy(&self) -> Result<Option<Proxy>, InvalidUri> {\n        self.build_proxy(\"http\", self.http.as_ref())\n    }\n\n    fn https_proxy(&self) -> Result<Option<Proxy>, InvalidUri> {\n        self.build_proxy(\"https\", self.https.as_ref())\n    }","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/lib/vector-core/src/config/proxy.rs#L151-L187","documentation":"The sibling of the username check: while attaching proxy authentication, Vector percent-decodes the password component of the proxy URL with urlencoding::decode(password).expect(\"Password must be valid UTF-8.\") (lib/vector-core/src/config/proxy.rs). If the percent-escapes in the password decode to bytes that are not valid UTF-8, building the Proxy-Authorization header panics.","triggerScenarios":"A proxy URL (from http_proxy/https_proxy env vars or the proxy config) that includes a userinfo password whose % sequences decode to invalid UTF-8, e.g. http://user:p%80w@proxy:3128. Triggered when Vector builds HTTP clients for sources/sinks with proxy support (during config load/topology build).","commonSituations":"Passwords generated by secrets managers that emit arbitrary bytes and are pasted into a URL without proper UTF-8 percent-encoding; shell quoting that mangles % or non-ASCII characters in env vars; copying proxy URLs between systems with different locale/encoding settings.","solutions":["Percent-encode the password's UTF-8 bytes correctly (e.g. ü -> %C3%BC), avoiding non-UTF-8 escapes like %80-%FF alone","Print the effective URL from the same environment Vector runs in (env | grep -i proxy) to spot mangling by shells, systemd, Docker, or Kubernetes","If the password genuinely contains non-UTF-8 bytes, rotate it to an ASCII/UTF-8 password — HTTP Basic auth cannot carry arbitrary bytes here"],"exampleFix":"# before\nexport http_proxy='http://user:p%80ssw0rd@proxy:3128'\n\n# after\nexport http_proxy='http://user:p%C3%BCssw0rd@proxy:3128'  # password 'püssw0rd'","handlingStrategy":"validation","validationCode":"fn proxy_password_is_utf8(url: &str) -> bool {\n    url::Url::parse(url)\n        .ok()\n        .and_then(|u| u.password().map(|p| percent_encoding::percent_decode_str(p).decode_utf8().is_ok()))\n        .unwrap_or(true)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Encode password bytes as UTF-8 percent-escapes; escape each byte of the multi-byte char","Prefer configuring proxy credentials through a store that guarantees UTF-8, not inline URLs","Audit env | grep -i proxy in the exact environment Vector runs in"],"tags":["vector","proxy","utf-8","url-encoding","http-proxy","panic","credentials"],"backgroundTag":"url-decode-invalid-utf8","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}