{"record":{"id":"c79fa76405c0fcb1","repo":"vectordotdev/vector","slug":"username-must-be-valid-utf-8","errorCode":null,"errorMessage":"username must be valid UTF-8.","messagePattern":"username must be valid UTF-8\\.","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/vector-core/src/config/proxy.rs","lineNumber":167,"sourceCode":"            no_proxy,\n        }\n    }\n\n    fn build_proxy(\n        &self,\n        proxy_scheme: &'static str,\n        proxy_url: Option<&String>,\n    ) -> Result<Option<Proxy>, InvalidUri> {\n        proxy_url\n            .as_ref()\n            .map(|url| {\n                url.parse().map(|parsed| {\n                    let mut proxy = Proxy::new(self.interceptor().intercept(proxy_scheme), parsed);\n                    if let Ok(authority) = Url::parse(url)\n                        && let Some(password) = authority.password()\n                    {\n                        let decoded_user = urlencoding::decode(authority.username())\n                            .expect(\"username must be valid UTF-8.\");\n                        let decoded_pw =\n                            urlencoding::decode(password).expect(\"Password must be valid UTF-8.\");\n                        let mut authorization =\n                            Authorization::basic(&decoded_user, &decoded_pw).0.encode();\n                        authorization.set_sensitive(true);\n                        proxy.set_header(PROXY_AUTHORIZATION, authorization);\n                    }\n                    proxy\n                })\n            })\n            .transpose()\n    }\n\n    fn http_proxy(&self) -> Result<Option<Proxy>, InvalidUri> {\n        self.build_proxy(\"http\", self.http.as_ref())\n    }\n\n    fn https_proxy(&self) -> Result<Option<Proxy>, InvalidUri> {","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/vectordotdev/vector/blob/3708c39b12a93212ed8b8d7510b4cc7769cb5864/lib/vector-core/src/config/proxy.rs#L149-L185","documentation":"When building an HTTP(S) proxy from a configured or environment-derived proxy URL, Vector decodes the percent-encoded username from the URL authority with urlencoding::decode(...).expect(\"username must be valid UTF-8.\") (lib/vector-core/src/config/proxy.rs). Percent-decoding yields raw bytes; if those bytes are not valid UTF-8 the decode fails and the expect panics while constructing the proxy interceptor chain.","triggerScenarios":"Setting http_proxy/https_proxy/all_proxy (or the proxy config fields) to a URL whose userinfo contains percent-encoded sequences that decode to invalid UTF-8, e.g. http://user%FF%FE:pass@proxy:8080. The panic occurs on proxy construction during HTTP client builder setup (Proxy::from_env / interceptor setup), i.e. typically at topology build time or on first request, and only when a password is also present (the decode runs inside the password branch).","commonSituations":"Proxy credentials containing non-UTF-8 bytes (legacy LDAP/system accounts) pasted as raw percent-escape sequences; hand-crafted proxy URLs where % sequences are mistyped (e.g. %FF from a truncated copy/paste); CI environments injecting proxy env vars from a secrets store that mangles encoding.","solutions":["Re-encode the proxy username as valid UTF-8 percent-encoding (encode the UTF-8 bytes of the real username, e.g. user%C3%A9 for 'useré')","Verify the URL with a standard parser first: python3 -c 'import urllib.parse; print(urllib.parse.unquote(\"...\"))' or curl -x — if those also fail, the URL bytes are wrong","If the credentials really contain non-UTF-8 bytes, change the proxy account password to a UTF-8-safe one, since RFC 3986 userinfo and HTTP Basic auth both assume UTF-8/ASCII"],"exampleFix":"# before\nexport https_proxy='http://user%FF%FE:pass@proxy.internal:8080'\n\n# after (é = U+00E9 = UTF-8 bytes C3 A9)\nexport https_proxy='http://user%C3%A9:pass@proxy.internal:8080'","handlingStrategy":"validation","validationCode":"fn proxy_userinfo_is_utf8(url: &str) -> bool {\n    let Ok(parsed) = url::Url::parse(url) else { return false };\n    if let Some(user) = parsed.username() {\n        if let Ok(bytes) = percent_encoding::percent_decode_str(user).decode_utf8() { let _ = bytes; } else { return false; }\n    }\n    true\n}\n// assert!(proxy_userinfo_is_utf8(&env_var));","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Percent-encode credentials from UTF-8 text only (é -> %C3%A9, never lone %80-%FF)","Validate proxy URLs with curl -x or python urllib.parse before exporting them","Keep secrets managers from injecting raw non-UTF-8 bytes into env vars"],"tags":["vector","proxy","utf-8","url-encoding","http-proxy","panic"],"backgroundTag":"url-decode-invalid-utf8","analyzedSha":"3708c39b12a93212ed8b8d7510b4cc7769cb5864","analyzedAt":"2026-08-20T07:02:18.786Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}