What causes "Deno permission values cannot be null or empty." in microsoft/aspire?

Filter out null/empty entries before calling: values.Where(v => !string.IsNullOrEmpty(v)).ToArray().

microsoft/aspire · error · ArgumentException

Deno permission values cannot be null or empty.

Error message

Deno permission values cannot be null or empty.

What it means

AddDenoPermission rejects null or empty strings in the permission values array because Deno would render them as a bare trailing '=' (e.g. --allow-read=), which older Deno treated oddly and Deno 2.9 rejects outright. The library fails at call time with ArgumentException instead of producing a command Deno refuses at startup.

Solutions

Filter out null/empty entries before calling: values.Where(v => !string.IsNullOrEmpty(v)).ToArray().
Fix the config source so empty segments are not produced (skip empty entries when splitting).
If you intentionally want the permission granted with no paths, omit the values entirely rather than passing "".

Example fix

// before
resource.WithDenoAllow(DenoPermissionKind.Read, config.Split(','));
// after
var values = config.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
if (values.Length > 0) resource.WithDenoAllow(DenoPermissionKind.Read, values);

Defensive patterns

Strategy: validation

Validate before calling

if (values.Any(v => string.IsNullOrEmpty(v))) throw new ArgumentException("Deno permission values must be non-empty strings.");

Try / catch

try { resource.WithDenoAllow(kind, values); } catch (ArgumentException ex) when (ex.ParamName == "values") { /* report offending config entry */ }

Prevention

Always use RemoveEmptyEntries when splitting permission lists
Sanitize config-derived string arrays before passing to params APIs
Add unit tests covering empty config values

When it happens

Trigger: Calling WithDenoAllow/WithDenoDeny (e.g. WithDenoAllow(DenoPermissionKind.Read, "", "path")) with any null or "" entry in the params array, commonly from splitting an empty or comma-joined config string into values.

Common situations: Splitting an environment-variable or appsettings value like "" or ",," into permission values; conditionally passing an uninitialized string variable into the params array.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/ab486376b27cd9d7. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting.JavaScript/DenoHostingExtensions.cs:76

            Kind = kind,
            Deny = deny,
            Values = snapshot,
        };

        // Deno delimits permission values with commas and offers no escape syntax, so a single value containing a
        // comma silently becomes several permissions. Verified on Deno 2.9.0: `--allow-read=data,secret` intended as
        // one directory named "data,secret" instead grants `data` and `secret` separately, so the requested path is
        // denied while unrelated paths are granted. Reject it here rather than emit a command line that means
        // something other than what the caller asked for.
        //
        // An empty params array intentionally emits an unscoped flag, but an individual null or empty value emits
        // `--allow-read=` (or the equivalent permission) and Deno 2.9 rejects it. Do not trim values: Deno accepts
        // whitespace as a permission value.
        foreach (var value in snapshot)
        {
            if (string.IsNullOrEmpty(value))
            {
                throw new ArgumentException("Deno permission values cannot be null or empty.", nameof(values));
            }

            if (value.Contains(','))
            {
                var flag = permission.Deny ? $"--deny-{permission.Name}" : $"--allow-{permission.Name}";
                throw new ArgumentException($"The value '{value}' cannot contain a comma. Deno separates {flag} values with commas and provides no way to escape them, so this value would be interpreted as multiple permissions. Pass each value as a separate argument.", nameof(values));
            }
        }

        var annotation = GetOrAddDenoAnnotation(builder);
        annotation.Permissions.Add(permission);
        return builder;
    }

    // ---- Blanket permission -----------------------------------------------------------------

    /// <summary>
    /// Controls the blanket <c>-A</c>/<c>--allow-all</c> grant.

View on GitHub (pinned to 25830f84bd)