{"record":{"id":"d054946788654919","repo":"quarkusio/quarkus","slug":"invalid-permissionsallowed-value-s-s","errorCode":null,"errorMessage":"Invalid @PermissionsAllowed value '%s': %s","messagePattern":"Invalid @PermissionsAllowed value '(.+?)': (.+?)","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java","lineNumber":611,"sourceCode":"        private <T extends AnnotationTarget> void gatherPermissionKeys(AnnotationInstance instance, T annotationTarget,\n                List<PermissionKey> cache, Map<T, List<List<PermissionKey>>> targetToPermissionKeys) {\n            boolean foundPermissionChecker = false;\n            final var permissionToActions = new HashMap<PermissionNameAndChecker, Set<String>>();\n            for (String permissionValExpression : instance.value().asStringArray()) {\n                final PermissionCheckerMetadata checker = permissionNameToChecker.get(permissionValExpression);\n                if (checker != null) {\n                    // matched @PermissionAllowed(\"value\") with @PermissionChecker(\"value\")\n                    foundPermissionChecker = true;\n                    final var permissionNameKey = new PermissionNameAndChecker(permissionValExpression, checker);\n                    if (!permissionToActions.containsKey(permissionNameKey)) {\n                        permissionToActions.put(permissionNameKey, Collections.emptySet());\n                    }\n                } else {\n                    final PermissionToActionUtil.ParsedPermission parsed;\n                    try {\n                        parsed = PermissionToActionUtil.parse(permissionValExpression);\n                    } catch (IllegalArgumentException e) {\n                        throw new RuntimeException(String.format(\n                                \"Invalid @PermissionsAllowed value '%s': %s\",\n                                permissionValExpression, e.getMessage()));\n                    }\n                    final PermissionNameAndChecker permissionNameKey = new PermissionNameAndChecker(parsed.name(),\n                            null);\n                    if (parsed.hasAction()) {\n                        final String action = parsed.action();\n                        if (permissionToActions.containsKey(permissionNameKey)) {\n                            permissionToActions.get(permissionNameKey).add(action);\n                        } else {\n                            final Set<String> actions = new HashSet<>();\n                            actions.add(action);\n                            permissionToActions.put(permissionNameKey, actions);\n                        }\n                    } else {\n                        if (!permissionToActions.containsKey(permissionNameKey)) {\n                            permissionToActions.put(permissionNameKey, new HashSet<>());\n                        }","sourceCodeStart":593,"sourceCodeEnd":629,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java#L593-L629","documentation":"Quarkus throws this at build time when a value inside @PermissionsAllowed cannot be parsed into a permission expression (name plus optional action list). PermissionToActionUtil.parse rejects malformed expressions (e.g. empty name, bad separator syntax, unbalanced quotes) and the builder wraps the parse failure in a RuntimeException that fails the deployment. It is a compile/deploy-time annotation validation, not a runtime security failure.","triggerScenarios":"Annotating a method or class with @PermissionsAllowed whose 'value' string cannot be parsed by PermissionToActionUtil.parse, e.g. @PermissionsAllowed(\"=\") , @PermissionsAllowed(\"-read\"), or a name with an illegal permission-to-action separator form.","commonSituations":"Typos in the 'name:action' expression syntax; copying examples using wrong separators; concatenating strings or constants that produce empty/blank values; upgrading Quarkus and the expression grammar became stricter.","solutions":["Fix the @PermissionsAllowed value string to valid syntax: a permission name optionally followed by action expressions, e.g. @PermissionsAllowed(\"get:single\"), @PermissionsAllowed(\"create\"), @PermissionsAllowed({\"read\", \"update\"}).","Check the underlying IllegalArgumentException message in the error output — it names the exact parse problem (empty name, illegal character, etc.) and correct that part of the string.","If the value is built from constants, print/inspect the composed string to ensure it is not blank or malformed.","Consult the @PermissionsAllowed section of the Quarkus security guide for the accepted expression grammar of your Quarkus version."],"exampleFix":"// before\n@PermissionsAllowed(\"\")\npublic String get() { ... }\n\n// after\n@PermissionsAllowed(\"get\")\npublic String get() { ... }","handlingStrategy":"validation","validationCode":"// Before deploying, validate each @PermissionsAllowed value parses:\n// In a unit test:\n@Test\nvoid permissionsAllowedValuesParse() {\n    for (String v : List.of(\"get:single\", \"create\")) {\n        assertDoesNotThrow(() -> io.quarkus.security.runtime.PermissionToActionUtil.parse(v));\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Follow the documented 'name:action' expression syntax exactly; test annotation values in a unit test using PermissionToActionUtil.parse.","Avoid composing annotation values dynamically from nullable/blank strings.","After a Quarkus upgrade, re-check the security guide for grammar changes."],"tags":["quarkus","security","permissionsallowed","annotation-validation"],"backgroundTag":"invalid-annotation-value","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}