{"record":{"id":"d175f4c8a4da4472","repo":"apache/hadoop","slug":"invalid-parameter-range-name-value-max-d175f4","errorCode":null,"errorMessage":"Invalid parameter range: {name} = {value} > {max}","messagePattern":"Invalid parameter range: (.+?) = (.+?) > (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/resources/ShortParam.java","lineNumber":37,"sourceCode":"\n/** Short parameter. */\nabstract class ShortParam extends Param<Short, ShortParam.Domain> {\n  ShortParam(final Domain domain, final Short value,\n      final Short min, final Short max) {\n    super(domain, value);\n    checkRange(min, max);\n  }\n\n  private void checkRange(final Short min, final Short max) {\n    if (value == null) {\n      return;\n    }\n    if (min != null && value < min) {\n      throw new IllegalArgumentException(\"Invalid parameter range: \" + getName()\n          + \" = \" + domain.toString(value) + \" < \" + domain.toString(min));\n    }\n    if (max != null && value > max) {\n      throw new IllegalArgumentException(\"Invalid parameter range: \" + getName()\n          + \" = \" + domain.toString(value) + \" > \" + domain.toString(max));\n    }\n  }\n\n  @Override\n  public String toString() {\n    return getName() + \"=\" + domain.toString(getValue());\n  }\n\n  /** @return the parameter value as a string */\n  @Override\n  public final String getValueString() {\n    return domain.toString(getValue());\n  }\n\n  /** The domain of the parameter. */\n  static final class Domain extends Param.Domain<Short> {\n    /** The radix of the number. */","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/web/resources/ShortParam.java#L19-L55","documentation":"The upper-bound half of ShortParam.checkRange (ShortParam.java:33-39): a non-null short parameter above the subclass maximum throws this IllegalArgumentException (HTTP 400). In practice this is the permission parameters: PermissionParam and UnmaskedPermissionParam both declare max 01777 (octal 1023, i.e. setuid+setgid+sticky plus rwxrwxrwx), parsed in radix 8. A permission octet with an extra leading digit beyond 1777 exceeds the range.","triggerScenarios":"?permission=2000 (octal 1024 > 1023); ?permission=7777; ?unmasked.permission=2755 — any 4-digit octal whose value exceeds 01777; also a decimal-looking value such as permission=888 is a parse error, but permission=1000 through 1777 are valid and above that fails.","commonSituations":"Copy-pasting 4-digit chmod modes like 2775/4775 as the whole permission — WebHDFS expects at most 3 mode digits plus the special bits within 1777; ACL-style masks mistakenly passed as permission.","solutions":["Send at most 01777: use 3-digit octal (644, 755) or special-bit forms up to 1777.","If you need to express setuid/setgid/sticky plus rwx, encode within 1777 (e.g. 1755); drop the extra digit.","For richer access control use the ACL operations (SETACL/MODIFYACLENTRIES) instead of oversized modes."],"exampleFix":"# before\ncurl -i -X PUT \"http://nn:9870/webhdfs/v1/f?op=CREATE&permission=2775\"\n# after\ncurl -i -X PUT \"http://nn:9870/webhdfs/v1/f?op=CREATE&permission=775\"","handlingStrategy":"validation","validationCode":"static short checkedOctalPermission(String perm) {        // radix-8, <= 01777\n  int v = Integer.parseInt(perm, 8);\n  if (v < 0 || v > 01777) throw new IllegalArgumentException(\"permission out of 0..1777 octal: \" + perm);\n  return (short) v;\n}","typeGuard":"static boolean isPermissibleOctalMode(String s) {\n  if (s == null || !s.matches(\"[0-7]{1,4}\")) return false;\n  return Integer.parseInt(s, 8) <= 01777;\n}","tryCatchPattern":null,"preventionTips":["Send at most 3 mode digits (plus special bits within 1777); never 4-digit chmod modes like 2775.","Normalize modes through a single helper that masks to 0777/1777."],"tags":["webhdfs","query-param","range-validation","permissions","hdfs"],"backgroundTag":"query-parameter-out-of-range","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}