{"record":{"id":"b81321b83d85ac58","repo":"hashicorp/nomad","slug":"invalid-variable-path-q-in-namespace-s-cannot-s","errorCode":null,"errorMessage":"Invalid variable path %q in namespace %s: cannot start with a leading '/'`","messagePattern":"Invalid variable path %q in namespace (.+?): cannot start with a leading '/'`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":601,"sourceCode":"\t\t// add to any existing capabilities\n\t\tif ns.Policy != \"\" {\n\t\t\textraCap := expandNamespacePolicy(ns.Policy)\n\t\t\tns.Capabilities = append(ns.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Expand implicit capabilities\n\t\texpandNamespaceCapabilities(ns)\n\n\t\tif ns.Variables != nil {\n\t\t\tif len(ns.Variables.Paths) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid variable policy: no variable paths in namespace %s\", ns.Name)\n\t\t\t}\n\t\t\tfor _, pathPolicy := range ns.Variables.Paths {\n\t\t\t\tif pathPolicy.PathSpec == \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"Invalid missing variable path in namespace %s\", ns.Name)\n\t\t\t\t}\n\t\t\t\tif strings.HasPrefix(pathPolicy.PathSpec, \"/\") {\n\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\"Invalid variable path %q in namespace %s: cannot start with a leading '/'`\",\n\t\t\t\t\t\tpathPolicy.PathSpec, ns.Name)\n\t\t\t\t}\n\t\t\t\tfor _, cap := range pathPolicy.Capabilities {\n\t\t\t\t\tif !isPathCapabilityValid(cap) {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\t\"Invalid variable capability '%s' in namespace %s\", cap, ns.Name)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tpathPolicy.Capabilities = expandVariablesCapabilities(pathPolicy.Capabilities)\n\n\t\t\t}\n\t\t}\n\n\t\t// Remove the namespace name from the extra key list.\n\t\tp.removeExtraKey(ns.Name)\n\t}\n","sourceCodeStart":583,"sourceCodeEnd":619,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L583-L619","documentation":"Returned by acl.Parse in acl/policy.go:601 when a variables path spec begins with '/'. Variables path specs are relative key prefixes (e.g. \"secret/app\") and must not start with a leading slash; the trailing backtick in the message is a literal typo in the source. The offending PathSpec and namespace name are included.","triggerScenarios":"Calling acl.Parse with a variables path like \"/secret/app\" or \"/\" inside a variables stanza — common when users write absolute-looking paths.","commonSituations":"Users familiar with absolute filesystem or Consul paths prefixing '/'; scripts joining path fragments with path.Join or string concatenation that yields a leading slash; migrating KV path configs from other systems.","solutions":["Strip the leading '/' from the path spec, e.g. \"/secret/app\" → \"secret/app\"","Use strings.TrimPrefix(spec, \"/\") when building paths programmatically","Review wildcard rules: path specs are prefix/relative patterns, not absolute paths"],"exampleFix":"// before\nvariables {\n  path \"/secret/app\" {\n    capabilities = [\"read\"]\n  }\n}\n// after\nvariables {\n  path \"secret/app\" {\n    capabilities = [\"read\"]\n  }\n}","handlingStrategy":"validation","validationCode":"for _, ns := range policy.Namespaces {\n    if ns.Variables == nil { continue }\n    for _, p := range ns.Variables.Paths {\n        if strings.HasPrefix(p.PathSpec, \"/\") {\n            return fmt.Errorf(\"namespace %s: path %q must not start with '/'\", ns.Name, p.PathSpec)\n        }\n    }\n}","typeGuard":"func isRelativeVarPath(spec string) bool { return spec != \"\" && !strings.HasPrefix(spec, \"/\") }","tryCatchPattern":null,"preventionTips":["Treat variables path specs as relative prefixes, never absolute paths","Use strings.TrimPrefix(spec, \"/\") when accepting user-supplied paths","Document the no-leading-slash rule wherever users enter variable paths"],"tags":["nomad","acl","variables","path-format"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}