microsoft/garnet · error · ACLParsingException

{exception.Message}

Error message

{exception.Message}

What it means

Thrown by ACLParser.ApplyACLOpToUser when a '#<hash>' or '!<hash>' operation references a password hash that ACLPassword.ACLPasswordFromHash cannot parse. The underlying ACLPasswordException (wrong length or non-hex format) is caught and re-thrown as an ACLParsingException with the original message, so the failure surfaces as a parse error with file/line context.

Source

Thrown at libs/server/ACL/ACLParser.cs:195

            }
            else if ((op[0] == '#') || (op[0] == '!'))
            {
                try
                {
                    if (op[0] == '#')
                    {
                        // Add password from hash
                        user.AddPasswordHash(ACLPassword.ACLPasswordFromHash(op.Substring(1)));
                    }
                    else
                    {
                        // Remove password from hash
                        user.RemovePasswordHash(ACLPassword.ACLPasswordFromHash(op.Substring(1)));
                    }
                }
                catch (ACLPasswordException exception)
                {
                    throw new ACLParsingException($"{exception.Message}");
                }
            }
            else if (op.StartsWith("-@", StringComparison.Ordinal) || op.StartsWith("+@", StringComparison.Ordinal))
            {
                // Parse category name
                string categoryName = op.Substring(2);

                RespAclCategories category;
                try
                {
                    category = ACLParser.GetACLCategoryByName(categoryName);
                }
                catch (KeyNotFoundException)
                {
                    throw new ACLCategoryDoesNotExistException(categoryName);
                }

                // Add or remove the category

View on GitHub (pinned to 951b0fc683)

Solutions

1. Supply the SHA-256 hash as exactly 64 lowercase-or-uppercase hex characters after '#' (add) or '!' (remove).
2. Generate the hash with: sha256sum of the UTF-8 password, or in code ACLPassword.ACLPasswordFromString(pw).ToString().
3. Use cleartext forms '>'/'<' if you have the raw password and want the library to hash it.
4. Validate hash length and hex-ness before writing the ACL line.

Example fix

// before
ACLParser.ParseACLRule("user alice on #short");

// after
ACLParser.ParseACLRule("user alice on #5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8");

string hash = op.Substring(1);
if (hash.Length != 64 || !System.Text.RegularExpressions.Regex.IsMatch(hash, "^[0-9a-fA-F]{64}$"))
    throw new ArgumentException("Password hash must be 64 hex chars (SHA-256).");

static bool IsValidHashOp(string op) =>
    (op[0]=='#'||op[0]=='!') && System.Text.RegularExpressions.Regex.IsMatch(op.Substring(1), @"^[0-9a-fA-F]{64}$");

try { ACLParser.ParseACLRule(line, acl); }
catch (ACLParsingException ex) { /* password hash parse error, report file:line */ }

When it happens

Trigger: An ACL rule using '#<hash>' to add (or '!<hash>' to remove) a password where the hash is not exactly 64 hex characters (32 bytes). For example '#abc' (too short) or '#zzzz...' (non-hex).

Common situations: Pasting a SHA-256 hash that was truncated or copied with extra characters; using a raw password instead of its hash after '#'; a hash generated by a different algorithm (not SHA-256) or a different encoding (base64 instead of hex).

Related errors

• Malformed ACL rule
• ACL rules need to start with the USER keyword
• {categoryName}
• {commandName}
• {op}

AI-assisted analysis of microsoft/garnet@951b0fc683 (2026-08-13). Data as JSON: /api/errors/c7f82dc784a629a6. Report an issue: GitHub.