{"record":{"id":"b46f5612f59ea229","repo":"quarkusio/quarkus","slug":"spiffe-id-is-not-a-valid-uri-spiffeid","errorCode":null,"errorMessage":"SPIFFE ID is not a valid URI: ${spiffeId}","messagePattern":"SPIFFE ID is not a valid URI: (.+?)","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":86,"sourceCode":"            throw new SpiffeConnectionException(\"SPIFFE ID must not be empty\");\n        }\n        if (spiffeId.length() > MAX_SPIFFE_ID_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID exceeds maximum length of \" + MAX_SPIFFE_ID_LENGTH\n                    + \" bytes: \" + spiffeId.length());\n        }\n\n        if (!spiffeId.startsWith(SPIFFE_URI_PREFIX)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have 'spiffe://' scheme: \" + spiffeId);\n        }\n        if (spiffeId.contains(\"%\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain percent-encoded characters: \" + spiffeId);\n        }\n\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L68-L104","documentation":"A SPIFFE ID must parse as a valid URI. SpiffeValidator.validateSpiffeId calls URI.create and wraps any IllegalArgumentException into a SpiffeConnectionException('SPIFFE ID is not a valid URI: ...'), so syntactically invalid strings (illegal characters, malformed scheme, etc.) are rejected with the original cause attached.","triggerScenarios":"Passing strings with illegal URI characters (spaces, '<', '|', unencoded non-ASCII), or malformed syntax like spiffe://example.org:path or 'spiffe://example .org/x' to SPIFFE ID validation.","commonSituations":"Concatenating untrusted/user input into identity paths without sanitization; copy-paste errors introducing whitespace; config values with trailing characters or line breaks.","solutions":["Remove or properly encode illegal characters from the SPIFFE ID (keeping in mind % is also forbidden).","Trim whitespace/newlines from config-sourced values.","Construct IDs only from validated trust-domain and path-segment values."],"exampleFix":"// before\nString id = \"spiffe://\" + trustDomain + \"/ns/\" + rawName.trim();\n// after\nString id = \"spiffe://\" + trustDomain + \"/ns/\" + sanitize(rawName); // [a-zA-Z0-9._-] only","handlingStrategy":"validation","validationCode":"try {\n    URI.create(spiffeId);\n} catch (IllegalArgumentException e) {\n    throw new IllegalStateException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    connection.establish();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"not a valid URI\")) {\n        log.error(\"SPIFFE ID contains illegal characters; sanitize identity input\", e);\n    }\n    throw e;\n}","preventionTips":["Restrict identity path segments to [a-zA-Z0-9._-]","Trim whitespace from config values before use","Validate IDs with URI.create in unit tests for ID-generation code"],"tags":["spiffe","validation","uri"],"backgroundTag":"spiffe-id-validation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}