{"record":{"id":"f8351c5926e01439","repo":"gravitational/teleport","slug":"want-attributevalue-found-eof","errorCode":null,"errorMessage":"want '=' attributeValue, found EOF","messagePattern":"want '=' attributeValue, found EOF","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"api/utils/pkixname/parser.go","lineNumber":580,"sourceCode":"\t\t\tswitch r {\n\t\t\tcase '+', ',', ';':\n\t\t\t\ttransitionToNameComponent(r)\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"want '+' or ',', found %q: %s\", r, errTrace(pos))\n\t\t\t}\n\t\t}\n\t}\n\n\t// Input ended, check the final state.\n\tswitch state {\n\tcase tokenizeStateInit:\n\t\t// OK.\n\tcase tokenizeStateNameComponent:\n\t\treturn nil, fmt.Errorf(\"want attributeType, found EOF\")\n\tcase tokenizeStateAttrType:\n\t\treturn nil, fmt.Errorf(\"want attributeType or '=', found EOF\")\n\tcase tokenizeStateAttrTypeEnd:\n\t\treturn nil, fmt.Errorf(\"want '=' attributeValue, found EOF\")\n\tcase tokenizeStateStringStart, tokenizeStateString, tokenizeStateStringEnd:\n\t\t// OK.\n\t\temitBuffer(tokenString)\n\tcase tokenizeStateStringEscape:\n\t\treturn nil, fmt.Errorf(\"want escaped character, found EOF\")\n\tcase tokenizeStateStringQuote:\n\t\treturn nil, fmt.Errorf(\"want closing quote, found EOF\")\n\tcase tokenizeStateStringQuoteEnd:\n\t\t// OK.\n\tdefault:\n\t\t// This should not be reached. All states are handled above.\n\t\treturn nil, fmt.Errorf(\"found EOF (state=%d)\", state)\n\t}\n\n\treturn tokens, nil\n}\n\nfunc isAttrType(r rune) bool {","sourceCodeStart":562,"sourceCodeEnd":598,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/api/utils/pkixname/parser.go#L562-L598","documentation":"The DN string ended after a complete attribute type (and optional whitespace) but before '='. Like error 168 but for the state where the type was terminated by whitespace, e.g. \"CN \" — the parser then requires '=' and instead hits end of input.","triggerScenarios":"Calling ParseDistinguishedName with input like \"CN \" or \"O=Corp, CN\" (trailing type with space, no '='), or strings that were trimmed right after an attribute type.","commonSituations":"DNs truncated at whitespace boundaries by formatters or templating, typo dropping '=value', or split/join logic that lost the value part.","solutions":["Append the missing '=value' after the attribute type, e.g. \"CN \" → \"CN=Bob\".","Remove the dangling attribute type and its trailing space.","Fix the upstream string construction so type and value are always emitted together."],"exampleFix":"// before\nname, err := pkixname.ParseDistinguishedName(\"O=Corp, CN \")\n// after\nname, err := pkixname.ParseDistinguishedName(\"O=Corp,CN=Bob\")","handlingStrategy":"validation","validationCode":"func danglingAttrTypeWithSpace(dn string) bool {\n\tparts := strings.Split(dn, \",\")\n\tlast := strings.TrimSpace(parts[len(parts)-1])\n\treturn !strings.Contains(last, \"=\")\n}","typeGuard":null,"tryCatchPattern":"name, err := pkixname.ParseDistinguishedName(dn)\nif err != nil {\n\tif strings.Contains(err.Error(), \"want '=' attributeValue, found EOF\") {\n\t\treturn nil, fmt.Errorf(\"DN %q ends after an attribute type; append '=value'\", dn)\n\t}\n\treturn nil, err\n}","preventionTips":["Never leave a trailing attribute type (with or without space) without a value","Watch for whitespace-trimming that separates type from its '=' value","Validate DNs before persisting them in config"],"tags":["x509","distinguished-name","parser","truncated-input"],"backgroundTag":"dn-truncated-attribute","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}