{"record":{"id":"ee5183c5b3f41ad8","repo":"kubernetes/kops","slug":"failed-to-parse-q-s","errorCode":null,"errorMessage":"failed to parse %q: %s","messagePattern":"failed to parse %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/context.go","lineNumber":576,"sourceCode":"\t\treturn nil, fmt.Errorf(\"invalid openstack cloud storage path: %q\", p)\n\t}\n\n\tbucket := strings.TrimSuffix(u.Host, \"/\")\n\tif bucket == \"\" {\n\t\treturn nil, fmt.Errorf(\"invalid swift path: %q\", p)\n\t}\n\n\treturn NewSwiftPath(c, bucket, u.Path)\n}\n\nfunc (c *VFSContext) buildAzureBlobPath(p string) (*AzureBlobPath, error) {\n\tif os.Getenv(\"AZURE_STORAGE_ACCOUNT\") != \"\" {\n\t\treturn nil, fmt.Errorf(\"unset AZURE_STORAGE_ACCOUNT; the storage account belongs in the URL:  azureblob://<account>/<container>/<key>\")\n\t}\n\n\tu, err := url.Parse(p)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse %q: %s\", p, err)\n\t}\n\n\tif u.Scheme != \"azureblob\" {\n\t\treturn nil, fmt.Errorf(\"invalid Azure Blob scheme: %q\", p)\n\t}\n\n\taccount := strings.TrimSuffix(u.Host, \"/\")\n\tif account == \"\" {\n\t\treturn nil, fmt.Errorf(\"no storage account specified in %q; expected azureblob://<account>/<container>/<key>\", p)\n\t}\n\n\trest := strings.TrimPrefix(u.Path, \"/\")\n\tcontainer, key, _ := strings.Cut(rest, \"/\")\n\tif container == \"\" {\n\t\treturn nil, fmt.Errorf(\"no container specified in %q; expected azureblob://<account>/<container>/<key>\", p)\n\t}\n\n\treturn NewAzureBlobPath(c, account, container, key), nil","sourceCodeStart":558,"sourceCodeEnd":594,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/context.go#L558-L594","documentation":"buildAzureBlobPath parses the azureblob:// URL with url.Parse and wraps any failure as \"failed to parse %q: %s\", including the underlying parse error text. The path never reached Azure.","triggerScenarios":"BuildVfsPath called with an azureblob:// URL that url.Parse rejects: invalid percent-escapes (e.g. \"%zz\"), embedded control characters or newlines, or other malformed URL syntax in the account/container/key.","commonSituations":"SAS tokens or keys containing % characters pasted unescaped into the URL; multi-line values from config files; secrets with special characters interpolated into the state-store string.","solutions":["Read the wrapped %s detail to see url.Parse's exact complaint","Percent-encode special characters (notably %, spaces, control chars) in the container/key portions","Trim whitespace/newlines from values read from files or environment before building the URL","Test the string with a tiny Go snippet calling url.Parse to reproduce the error locally"],"exampleFix":"// before\np := \"azureblob://acct/container/sas?sig=%zz\"\ncontext.BuildVfsPath(p) // failed to parse\n// after\np := \"azureblob://acct/container/\" + url.QueryEscape(sig)\ncontext.BuildVfsPath(p)","handlingStrategy":"validation","validationCode":"if _, err := url.Parse(stateStore); err != nil { return fmt.Errorf(\"azureblob state store %q is not a valid URL: %v\", stateStore, err) }","typeGuard":"func isParsableAzureBlobURL(p string) bool { _, err := url.Parse(p); return err == nil }","tryCatchPattern":"if _, err := context.BuildVfsPath(p); err != nil { if strings.Contains(err.Error(), \"failed to parse\") { /* log err's wrapped url.Parse detail and the %q path */ } return err }","preventionTips":["Percent-encode % and special characters in keys/SAS tokens","Strip newlines when reading URLs from config files or env","Reproduce suspicious URLs with url.Parse in a scratch test"],"tags":["azure","azureblob","url-parsing","vfs"],"backgroundTag":"invalid-storage-url","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}