{"record":{"id":"cca5a79a4fd2470a","repo":"puppetlabs/puppet","slug":"failed-to-convert-string-sid-string-sid","errorCode":null,"errorMessage":"Failed to convert string SID: %{string_sid}","messagePattern":"Failed to convert string SID: %(.+?)","errorType":"exception","errorClass":"Puppet::Util::Windows::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/sid.rb","lineNumber":193,"sourceCode":"          end\n\n          sid_string = wide_string_ptr.read_arbitrary_wide_string_up_to(MAXIMUM_SID_STRING_LENGTH)\n        end\n      end\n\n      sid_string\n    end\n    module_function :sid_ptr_to_string\n\n    # Convert a SID string, e.g. \"S-1-5-32-544\" to a pointer (containing the\n    # address of the binary SID structure). The returned value can be used in\n    # Win32 APIs that expect a PSID, e.g. IsValidSid. The account for this\n    # SID may or may not exist.\n    def string_to_sid_ptr(string_sid, &block)\n      FFI::MemoryPointer.from_string_to_wide_string(string_sid) do |lpcwstr|\n        FFI::MemoryPointer.new(:pointer, 1) do |sid_ptr_ptr|\n          if ConvertStringSidToSidW(lpcwstr, sid_ptr_ptr) == FFI::WIN32_FALSE\n            raise Puppet::Util::Windows::Error, _(\"Failed to convert string SID: %{string_sid}\") % { string_sid: string_sid }\n          end\n\n          sid_ptr_ptr.read_win32_local_pointer do |sid_ptr|\n            yield sid_ptr\n          end\n        end\n      end\n\n      # yielded sid_ptr has already had LocalFree called, nothing to return\n      nil\n    end\n    module_function :string_to_sid_ptr\n\n    # Return true if the string is a valid SID, e.g. \"S-1-5-32-544\", false otherwise.\n    def valid_sid?(string_sid)\n      valid = false\n\n      begin","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/sid.rb#L175-L211","documentation":"Raised by Puppet::Util::Windows::SID.string_to_sid_ptr when ConvertStringSidToSidW fails to parse the argument into a binary SID. The message embeds the offending input, and Puppet::Util::Windows::Error carries the Win32 code — typically ERROR_INVALID_SID_STRUCTURE (1337) for malformed strings. The yielded pointer is what Win32 APIs expecting PSID consume.","triggerScenarios":"Passing strings like 'S-1-5-32' (missing authority), '1-5-32-544' (no S- prefix), 'S-1-5-32-544-' (trailing dash), values with whitespace or non-numeric sub-authorities, or nil/non-String input; also SIDs with more than the allowed sub-authorities.","commonSituations":"Manifest or facts data feeding malformed SIDs into ACL management; copy/paste typos in SDDL strings; user data pulled from a CSV/database with stray characters; code passing a fully-qualified account name where the SID string was assumed.","solutions":["Validate the format first with the library's own helper: Puppet::Util::Windows::SID.valid_sid?('S-1-5-32-544') — it swallows ERROR_INVALID_SID_STRUCTURE and returns false.","Correct the string: must match ^S-\\d+-\\d+(-\\d+){0,13}$ with no trailing dash or spaces.","If the input is an account name, resolve it first via name_to_principal and use principal.sid.","Trim/normalize input from external data sources before conversion."],"exampleFix":"# before\nPuppet::Util::Windows::SID.string_to_sid_ptr(maybe_bad_sid) { |ptr| ... }\n\n# after\nraise ArgumentError, \"bad SID: #{maybe_bad_sid}\" unless Puppet::Util::Windows::SID.valid_sid?(maybe_bad_sid)\nPuppet::Util::Windows::SID.string_to_sid_ptr(maybe_bad_sid) { |ptr| ... }","handlingStrategy":"validation","validationCode":"# validate before converting\nSID_PATTERN = /\\AS-1-(\\d{1,10}-){0,14}\\d{1,10}\\z/\nraise ArgumentError, \"malformed SID string: #{sid.inspect}\" unless sid.is_a?(String) && sid.match?(SID_PATTERN)\n\n# or use the library helper\nreturn unless Puppet::Util::Windows::SID.valid_sid?(sid)","typeGuard":"def sid_string?(v)\n  v.is_a?(String) && v.match?(/\\AS-1-(\\d{1,10}-){0,14}\\d{1,10}\\z/)\nend","tryCatchPattern":"begin\n  Puppet::Util::Windows::SID.string_to_sid_ptr(sid) { |ptr| ... }\nrescue Puppet::Util::Windows::Error => e\n  raise unless e.code == 1337 # ERROR_INVALID_SID_STRUCTURE\n  raise ArgumentError, \"invalid SID string: #{sid}\"\nend","preventionTips":["Run valid_sid? on all externally sourced SID strings (facts, CSVs, ENC data) before use.","Resolve account names to principals (name_to_principal) instead of hand-typing SIDs.","Trim whitespace and strip trailing punctuation from data-fed SDDL fragments."],"tags":["windows","sid","sddl","validation","win32","puppet"],"backgroundTag":"sid-string-conversion-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}