{"record":{"id":"df4e04f7a86bb0c9","repo":"t8y2/dbx","slug":"token-is-empty-df4e04","errorCode":null,"errorMessage":"token is empty","messagePattern":"token is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":759,"sourceCode":"\t}\n\ttoken := firstNonEmpty(parameter(values, \"delegationtoken\"), parameter(values, \"token\"), config.Password)\n\tif token == \"\" {\n\t\treturn errors.New(\"Hive delegation token authentication requires delegationToken, token, or password\")\n\t}\n\tconfig.DelegationToken = token\n\tidentifier, password, err := decodeHadoopDelegationToken(token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decode Hive delegation token: %w\", err)\n\t}\n\tconfig.Username = base64.StdEncoding.EncodeToString(identifier)\n\tconfig.Password = base64.StdEncoding.EncodeToString(password)\n\treturn nil\n}\n\nfunc decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {\n\tencoded := strings.Join(strings.Fields(strings.TrimSpace(value)), \"\")\n\tif encoded == \"\" {\n\t\treturn nil, nil, errors.New(\"token is empty\")\n\t}\n\tvar decoded []byte\n\tvar decodeErr error\n\tfor _, encoding := range []*base64.Encoding{\n\t\tbase64.RawURLEncoding,\n\t\tbase64.URLEncoding,\n\t\tbase64.RawStdEncoding,\n\t\tbase64.StdEncoding,\n\t} {\n\t\tdecoded, decodeErr = encoding.DecodeString(encoded)\n\t\tif decodeErr == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif decodeErr != nil {\n\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))","sourceCodeStart":741,"sourceCodeEnd":777,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L741-L777","documentation":"decodeHadoopDelegationToken strips all whitespace from the input and, if nothing remains, rejects it with 'token is empty'. The token must then decode as base64 into a Hadoop Token protobuf. This fires after applyDelegationToken found some token source but it was effectively blank.","triggerScenarios":"Passing delegationToken/token/password set to \"\", spaces, or only newlines; a template/config placeholder (like ${TOKEN}) resolved to empty; the token variable never assigned before decode is called.","commonSituations":"Secret managers returning empty values for missing keys, shell scripts where $(command) failed and emitted nothing, YAML/properties files with key present but value blank.","solutions":["Provide the actual base64-encoded delegation token string.","Print/check the token length (without logging the token itself) before connecting to confirm it is non-empty.","Fix the upstream secret retrieval (env var name, vault path) that returned an empty value."],"exampleFix":"// before\nparams[\"delegationToken\"] = os.Getenv(\"HIVE_TOKEN\") // env unset -> \"\"\n// after\ntok := os.Getenv(\"HIVE_TOKEN\")\nif tok == \"\" { return fmt.Errorf(\"HIVE_TOKEN is not set\") }\nparams[\"delegationToken\"] = tok","handlingStrategy":"validation","validationCode":"func ensureNonEmptyToken(v string) error {\n    if strings.TrimSpace(v) == \"\" {\n        return errors.New(\"delegation token is empty\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail fast when secret lookups return empty values","Log token length (not content) before connecting","Avoid shell substitutions that silently expand to empty strings"],"tags":["hive","authentication","delegation-token","base64"],"backgroundTag":"missing-credential","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}