{"record":{"id":"d681aa4cf1f63bfd","repo":"quarkusio/quarkus","slug":"permission-value-raw-contains-more-than-one-u","errorCode":null,"errorMessage":"Permission value '${raw}' contains more than one unescaped colon separator, use \\: for a literal colon","messagePattern":"Permission value '(.+?)' contains more than one unescaped colon separator, use \\\\: for a literal colon","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/PermissionToActionUtil.java","lineNumber":47,"sourceCode":"        char[] chars = raw.toCharArray();\n\n        for (int i = 0; i < chars.length; i++) {\n            switch (chars[i]) {\n                case '\\\\':\n                    if (++i == chars.length || chars[i] != ':') {\n                        throw new IllegalArgumentException(\n                                \"Invalid escape sequence in permission value '\" + raw\n                                        + \"': backslash is only allowed before a colon (\\\\:)\");\n                    }\n                    if (foundSeparator) {\n                        action.append(':');\n                    } else {\n                        name.append(':');\n                    }\n                    break;\n                case ':':\n                    if (foundSeparator) {\n                        throw new IllegalArgumentException(\n                                \"Permission value '\" + raw\n                                        + \"' contains more than one unescaped colon separator, use \\\\: for a literal colon\");\n                    }\n                    foundSeparator = true;\n                    break;\n                default:\n                    if (foundSeparator) {\n                        action.append(chars[i]);\n                    } else {\n                        name.append(chars[i]);\n                    }\n            }\n        }\n\n        if (!foundSeparator) {\n            return new ParsedPermissionImpl(name.toString(), null);\n        }\n        if (name.isEmpty()) {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/PermissionToActionUtil.java#L29-L65","documentation":"The permission value format is 'name[:action]' — at most one unescaped colon separating the permission class from its action. A second unescaped colon means the parser cannot tell where the action begins, so it throws IllegalArgumentException. Use '\\:' to embed a literal colon.","triggerScenarios":"A config value like 'com.a.Perm:read:write' or any value containing more than one raw colon passed to parse().","commonSituations":"Trying to express multiple actions in one entry separated by colons; permissions whose class name legitimately contains colons without escaping; copy-paste from URI-like strings.","solutions":["Use exactly one ':' separating class and action; express multiple actions with commas if the consumer supports it, e.g. 'com.app.Perm:read,write'.","Escape literal colons inside the name/action with '\\:'.","Split into multiple permission entries instead of stuffing several into one value."],"exampleFix":"# before\nperm=com.app.Perm:read:write\n\n# after\nperm=com.app.Perm:read,write","handlingStrategy":"validation","validationCode":"int unescaped = 0;\nfor (int i = 0; i < raw.length(); i++) {\n    char c = raw.charAt(i);\n    if (c == '\\\\') { i++; continue; }\n    if (c == ':') unescaped++;\n}\nboolean valid = unescaped <= 1;","typeGuard":null,"tryCatchPattern":"try { PermissionToActionUtil.parse(raw); } catch (IllegalArgumentException e) { /* reduce to one unescaped colon */ }","preventionTips":["Format values strictly as 'Name' or 'Name:action'","Escape literal colons with backslash","Split multi-action values into separate entries or comma lists"],"tags":["security","configuration","permissions"],"backgroundTag":"security-permission-config-invalid","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}