{"record":{"id":"c7318e13e61983ef","repo":"microsoft/aspire","slug":"helm-chart-reference-chartreference-is-invalid-use-oci-http","errorCode":null,"errorMessage":"Helm chart reference '{chartReference}' is invalid. Use OCI/HTTP URLs, repo/chart names, or local paths containing only letters, digits, '.', '-', '_', '/', ':', '@', '+', '~'.","messagePattern":"Helm chart reference '(.+?)' is invalid\\. Use OCI/HTTP URLs, repo/chart names, or local paths containing only letters, digits, '\\.', '-', '_', '/', ':', '@', '\\+', '~'\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Kubernetes/KubernetesHelmChartExtensions.cs","lineNumber":527,"sourceCode":"        => $\"HelmChart:{environment.Name}:{chart.Name}\";\n\n    // Allowlist for Helm chart references. Covers OCI URLs (oci://host/path), HTTP/HTTPS URLs,\n    // local paths, plain chart names (\"repo/chart\"), and packaged chart filenames. Rejects anything\n    // that could break helm argument tokenization (whitespace, quotes, control chars).\n    [GeneratedRegex(@\"^[A-Za-z0-9_./:@+~\\-]+$\")]\n    private static partial Regex ChartReferencePattern();\n\n    // Disallowed in helm --set keys: anything that would break the key=value tokenization or\n    // interact with helm's escape syntax. Allow alphanumerics plus dot, dash, underscore,\n    // and brackets (for indexed/array paths like \"args[0]\").\n    [GeneratedRegex(@\"^[A-Za-z0-9_.\\-\\[\\]]+$\")]\n    private static partial Regex HelmSetKeyPattern();\n\n    private static void ValidateChartReference(string chartReference, string paramName)\n    {\n        if (!ChartReferencePattern().IsMatch(chartReference))\n        {\n            throw new ArgumentException(\n                $\"Helm chart reference '{chartReference}' is invalid. Use OCI/HTTP URLs, repo/chart names, or local paths containing only letters, digits, '.', '-', '_', '/', ':', '@', '+', '~'.\",\n                paramName);\n        }\n    }\n\n    private static void ValidateHelmSetKey(string key, string paramName)\n    {\n        if (!HelmSetKeyPattern().IsMatch(key))\n        {\n            throw new ArgumentException(\n                $\"Helm value key '{key}' is invalid. Use letters, digits, '.', '-', '_', or brackets for indexed paths.\",\n                paramName);\n        }\n    }\n\n    private static void ValidateHelmSetValue(string value, string paramName)\n    {\n        // Reject control characters (newlines, tabs) and double-quotes that would break the","sourceCodeStart":509,"sourceCodeEnd":545,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Kubernetes/KubernetesHelmChartExtensions.cs#L509-L545","documentation":"Aspire's Kubernetes hosting API validates Helm chart references passed to AddHelmChart before invoking Helm. The value is checked against a ChartReferencePattern regex that permits only OCI/HTTP(S) URLs, repo/chart names, or local paths composed of letters, digits, and the characters . - _ / : @ + ~. Anything containing spaces, quotes, shell metacharacters, or other disallowed characters is rejected with this ArgumentException.","triggerScenarios":"Calling AddHelmChart (or WithChartReference overloads that route to ValidateChartReference) with a chart reference containing characters outside the allowed set, e.g. 'bitnami/nginx (stable)', a URL with query string '?version=1.0', a quoted name, a path with spaces, or a reference using characters like '%', '#', ',', or '='.","commonSituations":"Copy-pasting a Helm command line argument (which may include flags or quotes) into the chart reference string; embedding an OCI reference with digest syntax containing characters outside the whitelist; using a Windows path with backslashes; appending version or values inline in the reference instead of using dedicated API parameters.","solutions":["Remove any characters not in the allowed set (letters, digits, '.', '-', '_', '/', ':', '@', '+', '~') from the chart reference.","Specify the chart version via the dedicated version parameter of AddHelmChart instead of embedding it in the reference.","For local charts, pass a path using forward slashes and without spaces; quote-free relative or absolute paths only.","For OCI charts use the oci://registry/repo/chart form; for HTTP use a full https:// URL with no query string.","For complex charts (set files, multiple values), use the WithHelmValue / --values-file style APIs rather than encoding options in the reference."],"exampleFix":"// before\nbuilder.AddHelmChart(\"web\", \"bitnami/nginx?version=15.0\");\n// after\nbuilder.AddHelmChart(\"web\", \"bitnami/nginx\", version: \"15.0\");","handlingStrategy":"validation","validationCode":"var allowed = new System.Text.RegularExpressions.Regex(\"^[a-zA-Z0-9./:_@+~-]+$\");\nif (string.IsNullOrEmpty(chartReference) || !allowed.IsMatch(chartReference))\n    throw new ArgumentException($\"Invalid chart reference: {chartReference}\");","typeGuard":null,"tryCatchPattern":"try { builder.AddHelmChart(name, chartReference); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"chart reference\"))\n{ logger.LogError(ex, \"Chart reference '{Ref}' contains unsupported characters\", chartReference); }","preventionTips":["Keep chart references limited to OCI URLs, https URLs, repo/chart names, or simple paths.","Pass chart versions via the dedicated version parameter, never inline in the reference.","Use forward slashes and avoid spaces in local chart paths."],"tags":["kubernetes","helm","validation","argument"],"backgroundTag":"invalid-argument-format","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}