google/tsunami-security-scanner · error · IllegalArgumentException

Parenthesis and/or brackets not allowed within version…

Error message

Parenthesis and/or brackets not allowed within version range, got '%s'

What it means

VersionRange.parse validates the range string after stripping the leading and trailing bracket/parenthesis. If any '[' , '(' or ')' character remains inside the trimmed string, the range is malformed and this IllegalArgumentException is thrown. Version ranges in Tsunami must look like '[1.0,2.0]' or '[1.0,)' — no nested or stray delimiters.

Solutions

1. Inspect the range string and remove any inner '[' , '(' or ')' characters, keeping exactly one opening delimiter at the start and one closing delimiter at the end.
2. Use VersionRange.isValidVersionRange(rangeString) to check the string before calling parse.
3. Build ranges with explicit min/max strings and a single bracket pair, e.g. "[" + min + "," + max + "]".

Example fix

// before
VersionRange.parse("[1.0,[2.0]");
// after
VersionRange.parse("[1.0,2.0]");

if (VersionRange.isValidVersionRange(rangeString)) { VersionRange.parse(rangeString); }

boolean isValidRange(String s) { return s != null && VersionRange.isValidVersionRange(s); }

try { VersionRange.parse(rangeString); } catch (IllegalArgumentException e) { log.error("Bad range: {}", e.getMessage()); }

When it happens

Trigger: Calling VersionRange.parse with a string that still contains '[', '(' or ')' after the outer delimiters are removed, e.g. parse("[1.0,[2.0]") or parse("[1.0, (2.5]").

Common situations: Hand-written vulnerability fingerprint version ranges with typos (extra bracket), programmatically built range strings where delimiters are concatenated twice, or copy-pasted Maven/npm-style range syntax that Tsunami's stricter grammar rejects.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid range of versions, got
• Infinity range is not supported, got
• String ' ' is neither a discrete string nor a version range.

AI-assisted analysis of google/tsunami-security-scanner@363ba87b35 (2026-09-13). Data as JSON: /api/errors/1cf8ba1416100b84. Report an issue: GitHub.

Appendix: source

Thrown at common/src/main/java/com/google/tsunami/common/version/VersionRange.java:144

    // Version range string must start with '[' or '('.
    if (!rangeString.startsWith("[") && !rangeString.startsWith("(")) {
      throw new IllegalArgumentException(
          String.format("Version range must start with '[' or '(', got '%s'", rangeString));
    }

    // Version range string must end with ']' or ')'.
    if (!rangeString.endsWith("]") && !rangeString.endsWith(")")) {
      throw new IllegalArgumentException(
          String.format("Version range must end with ']' or ')', got '%s'", rangeString));
    }

    // Remove the leading and ending parenthesis and brackets.
    String trimmedRange = rangeString.substring(1, rangeString.length() - 1).trim();

    // No more parenthesis and brackets in the string.
    if (CharMatcher.anyOf("[()]").matchesAnyOf(trimmedRange)) {
      throw new IllegalArgumentException(
          String.format(
              "Parenthesis and/or brackets not allowed within version range, got '%s'",
              rangeString));
    }

    // Only one comma that separates the minimum and maximum.
    if (CharMatcher.is(',').countIn(trimmedRange) != 1) {
      throw new IllegalArgumentException(
          String.format("Invalid range of versions, got '%s'", rangeString));
    }

    // Version range of minimum to maximum is not supported.
    if (trimmedRange.equals(",")) {
      throw new IllegalArgumentException(
          String.format("Infinity range is not supported, got '%s'", rangeString));
    }
  }
}

View on GitHub (pinned to 363ba87b35)