{"record":{"id":"c7f82dc784a629a6","repo":"microsoft/garnet","slug":"exception-message","errorCode":null,"errorMessage":"{exception.Message}","messagePattern":"\\{exception\\.Message\\}","errorType":"validation","errorClass":"ACLParsingException","httpStatus":null,"severity":"error","filePath":"libs/server/ACL/ACLParser.cs","lineNumber":195,"sourceCode":"            }\n            else if ((op[0] == '#') || (op[0] == '!'))\n            {\n                try\n                {\n                    if (op[0] == '#')\n                    {\n                        // Add password from hash\n                        user.AddPasswordHash(ACLPassword.ACLPasswordFromHash(op.Substring(1)));\n                    }\n                    else\n                    {\n                        // Remove password from hash\n                        user.RemovePasswordHash(ACLPassword.ACLPasswordFromHash(op.Substring(1)));\n                    }\n                }\n                catch (ACLPasswordException exception)\n                {\n                    throw new ACLParsingException($\"{exception.Message}\");\n                }\n            }\n            else if (op.StartsWith(\"-@\", StringComparison.Ordinal) || op.StartsWith(\"+@\", StringComparison.Ordinal))\n            {\n                // Parse category name\n                string categoryName = op.Substring(2);\n\n                RespAclCategories category;\n                try\n                {\n                    category = ACLParser.GetACLCategoryByName(categoryName);\n                }\n                catch (KeyNotFoundException)\n                {\n                    throw new ACLCategoryDoesNotExistException(categoryName);\n                }\n\n                // Add or remove the category","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/server/ACL/ACLParser.cs#L177-L213","documentation":"Thrown by ACLParser.ApplyACLOpToUser when a '#<hash>' or '!<hash>' operation references a password hash that ACLPassword.ACLPasswordFromHash cannot parse. The underlying ACLPasswordException (wrong length or non-hex format) is caught and re-thrown as an ACLParsingException with the original message, so the failure surfaces as a parse error with file/line context.","triggerScenarios":"An ACL rule using '#<hash>' to add (or '!<hash>' to remove) a password where the hash is not exactly 64 hex characters (32 bytes). For example '#abc' (too short) or '#zzzz...' (non-hex).","commonSituations":"Pasting a SHA-256 hash that was truncated or copied with extra characters; using a raw password instead of its hash after '#'; a hash generated by a different algorithm (not SHA-256) or a different encoding (base64 instead of hex).","solutions":["Supply the SHA-256 hash as exactly 64 lowercase-or-uppercase hex characters after '#' (add) or '!' (remove).","Generate the hash with: sha256sum of the UTF-8 password, or in code ACLPassword.ACLPasswordFromString(pw).ToString().","Use cleartext forms '>'/'<' if you have the raw password and want the library to hash it.","Validate hash length and hex-ness before writing the ACL line."],"exampleFix":"// before\nACLParser.ParseACLRule(\"user alice on #short\");\n\n// after\nACLParser.ParseACLRule(\"user alice on #5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8\");","handlingStrategy":"validation","validationCode":"string hash = op.Substring(1);\nif (hash.Length != 64 || !System.Text.RegularExpressions.Regex.IsMatch(hash, \"^[0-9a-fA-F]{64}$\"))\n    throw new ArgumentException(\"Password hash must be 64 hex chars (SHA-256).\");","typeGuard":"static bool IsValidHashOp(string op) =>\n    (op[0]=='#'||op[0]=='!') && System.Text.RegularExpressions.Regex.IsMatch(op.Substring(1), @\"^[0-9a-fA-F]{64}$\");","tryCatchPattern":"try { ACLParser.ParseACLRule(line, acl); }\ncatch (ACLParsingException ex) { /* password hash parse error, report file:line */ }","preventionTips":["Use ACLPassword.ACLPasswordFromString(pw).ToString() to generate valid hashes.","Prefer cleartext '>' form if you have the raw password.","Validate 64-hex format before writing the ACL line."],"tags":["acl","parsing","password","hash","configuration"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}