{"record":{"id":"d2eb75b59ca0029d","repo":"apache/pulsar","slug":"access-to-environment-variable-s-is-not-allowed","errorCode":null,"errorMessage":"Access to environment variable %s is not allowed.","messagePattern":"Access to environment variable (.+?) is not allowed\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"pulsar-functions/instance/src/main/java/org/apache/pulsar/functions/instance/ContextImpl.java","lineNumber":347,"sourceCode":"    }\n\n    @Override\n    public Logger getLogger() {\n        return logger;\n    }\n\n    @Override\n    public Optional<Object> getUserConfigValue(String key) {\n        Object value = userConfigs.getOrDefault(key, null);\n\n        if (value instanceof String && ((String) value).startsWith(\"$\")) {\n            // any string starts with '$' is considered as system env symbol and will be\n            // replaced with the actual env value\n            try {\n                String actualValue = System.getenv(((String) value).substring(1));\n                return Optional.ofNullable(actualValue);\n            } catch (SecurityException ex) {\n                throw new RuntimeException(\"Access to environment variable \" + value + \" is not allowed.\", ex);\n            }\n        } else {\n            return Optional.ofNullable(value);\n        }\n    }\n\n    @Override\n    public Object getUserConfigValueOrDefault(String key, Object defaultValue) {\n        return getUserConfigValue(key).orElse(defaultValue);\n    }\n\n    @Override\n    public Map<String, Object> getUserConfigMap() {\n        return userConfigs;\n    }\n\n    @Override\n    public String getSecret(String secretName) {","sourceCodeStart":329,"sourceCodeEnd":365,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-functions/instance/src/main/java/org/apache/pulsar/functions/instance/ContextImpl.java#L329-L365","documentation":"getUserConfigValue treats any string config value starting with '$' as an environment-variable reference and substitutes System.getenv(). If the JVM's SecurityManager denies reading that environment variable, a SecurityException is caught and rethrown as a RuntimeException stating access to the environment variable is not allowed.","triggerScenarios":"A user config value looks like \"$MY_VAR\" (single $ prefix), the function worker's security policy (Java SecurityManager) blocks System.getenv for that name, and the function calls context.getUserConfigValue(\"key\") (directly or via getUserConfigValueOrDefault).","commonSituations":"Config values that accidentally start with '$' (e.g. \"$password\", shell-style literals pasted into config); hardened function-worker policies restricting env access; running functions inside containers with restricted JVM permissions.","solutions":["Remove or change the '$' prefix in the user config if the value is meant to be a literal string (escape/double it per docs if needed).","Set the referenced environment variable in the function's runtime environment so it exists and is readable.","Relax the function worker's security policy / JVM permissions to allow System.getenv for that variable."],"exampleFix":"// before\nString secret = (String) context.getUserConfigValue(\"secret\"); // value in config: \"$SECRET_TOKEN\"\n// after\n// change config value to the literal or inject the env var into the function pod,\n// then:\nString secret = (String) context.getUserConfigValueOrDefault(\"secret\", \"default\");","handlingStrategy":"validation","validationCode":"Object v = context.getUserConfig(\"key\");\nif (v instanceof String s && s.startsWith(\"$\") && System.getenv(s.substring(1)) == null) {\n    throw new IllegalStateException(\"Env var \" + s.substring(1) + \" not resolvable for config key\");\n}","typeGuard":null,"tryCatchPattern":"try { return context.getUserConfigValue(\"key\"); } catch (RuntimeException e) { if (e.getMessage().contains(\"Access to environment variable\")) { return Optional.of(defaultValue); } throw e; }","preventionTips":["Avoid literal config values starting with '$' unless env substitution is intended","Define the referenced env vars in the function's runtime environment","Check function worker security policies before relying on env lookups"],"tags":["pulsar-functions","security","environment-variable","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}