hyperledger/fabric · error

name '%s' for config ID is not allowed

Error message

name '%s' for config ID is not allowed

What it means

validateConfigID rejects identifiers that are in the illegalNames set (reserved names such as "." and ".."). Reserved strings would be ambiguous or dangerous in config path traversal, so they are explicitly disallowed.

Source

Thrown at common/configtx/validator.go:59

}

// validateConfigID makes sure that the config element names (ie map key of
// ConfigGroup) comply with the following restrictions
//  1. Contain only ASCII alphanumerics, dots '.', dashes '-'
//  2. Are shorter than 250 characters.
//  3. Are not the strings "." or "..".
func validateConfigID(configID string) error {
	re, _ := regexp.Compile(configAllowedChars)
	// Length
	if len(configID) <= 0 {
		return errors.New("config ID illegal, cannot be empty")
	}
	if len(configID) > MaxLength {
		return errors.Errorf("config ID illegal, cannot be longer than %d", MaxLength)
	}
	// Illegal name
	if _, ok := illegalNames[configID]; ok {
		return errors.Errorf("name '%s' for config ID is not allowed", configID)
	}
	// Illegal characters
	matched := re.FindString(configID)
	if len(matched) != len(configID) {
		return errors.Errorf("config ID '%s' contains illegal characters", configID)
	}

	return nil
}

// ValidateChannelID makes sure that proposed channel IDs comply with the
// following restrictions:
//  1. Contain only lower case ASCII alphanumerics, dots '.', and dashes '-'
//  2. Are shorter than 250 characters.
//  3. Start with a letter
//
// This is the intersection of the Kafka restrictions and CouchDB restrictions
// with the following exception: '.' is converted to '_' in the CouchDB naming

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Replace the reserved name with an explicit, unique identifier
2. Sanitize generated names against the illegalNames set before use
3. Review the config generation code to ensure path segments are not passed through unfiltered
4. Use configtxlator to decode and inspect the submitted config to locate the bad key

Example fix

// before
name := path.Base(dir) // can be "." or ".."
group.Groups[name] = &cb.ConfigGroup{}
// after
name := path.Base(dir)
if name == "." || name == ".." {
    return errors.Errorf("reserved name %q not allowed as config ID", name)
}

var reserved = map[string]bool{".": true, "..": true}
if reserved[configID] {
    return errors.Errorf("reserved name %q not allowed", configID)
}

func notReservedName(id string) bool {
    return id != "." && id != ".."
}

if err := validateName(id); err != nil {
    return fmt.Errorf("config name rejected: %w", err)
}

When it happens

Trigger: Using ".", "..", or another reserved name as a config group/value/policy key in a ConfigUpdate or new channel config.

Common situations: Relative-path-style keys leaking into config generation code; template-driven config builders emitting default placeholder names; users copying filesystem path segments into config IDs.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• config ID illegal, cannot be empty
• config ID illegal, cannot be longer than %d
• config ID '%s' contains illegal characters
• channel ID illegal, cannot be empty
• channel ID illegal, cannot be longer than %d

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/03126ef80ebb6cfb. Report an issue: GitHub.