{"record":{"id":"ca5685ba0166d219","repo":"gravitational/teleport","slug":"unexpected-escaped-character-q-s","errorCode":null,"errorMessage":"unexpected escaped character %q: %s","messagePattern":"unexpected escaped character %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/utils/pkixname/parser.go","lineNumber":547,"sourceCode":"\t\t\t\ttrailingSpaceBuf.WriteRune(r)\n\t\t\t\tstate = tokenizeStateStringEnd\n\t\t\tcase '=', '#': // Go does this.\n\t\t\t\t// NOT OK per RFC, should be escaped.\n\t\t\t\tfallthrough\n\t\t\tdefault:\n\t\t\t\tbuf.WriteRune(r)\n\t\t\t}\n\n\t\tcase tokenizeStateStringEscape:\n\t\t\tswitch r {\n\t\t\tcase ' ': // Go does this.\n\t\t\t\t// OK per RFC and allows the \"\\\\ \" trick.\n\t\t\t\tfallthrough\n\t\t\tcase ',', '=', '+', '<', '>', '#', ';', '\\\\', '\"':\n\t\t\t\tbuf.WriteRune(r)\n\t\t\t\tescapeEnd()\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"unexpected escaped character %q: %s\", r, errTrace(pos))\n\t\t\t}\n\n\t\tcase tokenizeStateStringQuote:\n\t\t\tswitch r {\n\t\t\tcase '\\\\':\n\t\t\t\tescapeStart()\n\t\t\tcase '\"':\n\t\t\t\temitBuffer(tokenString)\n\t\t\t\tstate = tokenizeStateStringQuoteEnd\n\t\t\tdefault:\n\t\t\t\tbuf.WriteRune(r)\n\t\t\t}\n\n\t\tcase tokenizeStateStringQuoteEnd:\n\t\t\tswitch r {\n\t\t\tcase '+', ',', ';':\n\t\t\t\ttransitionToNameComponent(r)\n\t\t\tdefault:","sourceCodeStart":529,"sourceCodeEnd":565,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/utils/pkixname/parser.go#L529-L565","documentation":"Backslash escapes are limited to the RFC 2253 specials (',' '=' '+' '<' '>' '#' ';' '\\' '\"') and space. Hex escapes like '\\\\13' or escapes of ordinary letters (e.g. \"\\\\n\", \"\\\\C\") are rejected with this error, unlike some other DN parsers (notably Go's crypto/x509 behavior differs).","triggerScenarios":"Calling ParseDistinguishedName with a DN containing an escape of a character outside the allowed set, e.g. \"CN=Bob\\\\, Jr.\" is fine but \"CN=Bob\\\\n\", \"CN=A\\\\41\", or \"O=Corp\\\\t\" fail.","commonSituations":"DNs escaped for a different parser (e.g. LDAP filter-style or Java LDAP escaping of non-specials), hex-escaped values copied from other tools, or accidentally doubled backslashes.","solutions":["Remove the unnecessary escape if the character needs none: \"CN=A\\\\41\" → \"CN=A\".","Escape only the RFC specials or space: use '\\\\,' not '\\\\13' for a comma.","Replace hex escapes with the literal character: \"CN=\\\\6E\" → \"CN=n\".","Sanitize/unescape non-special backslash sequences before passing the DN to ParseDistinguishedName."],"exampleFix":"// before\nname, err := pkixname.ParseDistinguishedName(\"CN=Bob\\\\41\")\n// after\nname, err := pkixname.ParseDistinguishedName(\"CN=BobA\")","handlingStrategy":"validation","validationCode":"var badEscapeRe = regexp.MustCompile(`\\\\[^ ,=+<>#;\\\\\" ]`)\nfunc hasInvalidEscape(dn string) bool { return badEscapeRe.MatchString(dn) }","typeGuard":null,"tryCatchPattern":"name, err := pkixname.ParseDistinguishedName(dn)\nif err != nil {\n\tif strings.Contains(err.Error(), \"unexpected escaped character\") {\n\t\treturn nil, fmt.Errorf(\"DN %q uses unsupported escapes (only specials and space): %w\", dn, err)\n\t}\n\treturn nil, err\n}","preventionTips":["Escape only RFC 2253 specials and space with backslash","Never use hex escapes like \\\\13 or \\\\41","Unescape non-special backslash sequences before parsing"],"tags":["x509","distinguished-name","escaping","parser"],"backgroundTag":"dn-invalid-escape-sequence","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}