microsoft/garnet · error · ACLParsingException

Malformed ACL rule

Error message

Malformed ACL rule

What it means

Thrown by ACLParser.ParseACLRule when the tokenized input has fewer than 3 tokens. A well-formed ACL rule is 'user <username> <op>...' — at minimum three whitespace-separated tokens. Fewer means the line is too short to be a valid rule. It is an ACLParsingException carrying filename and line number context when reached via file import.

Source

Thrown at libs/server/ACL/ACLParser.cs:88

        ///     !<hash>: Remove the password hash from the list of valid passwords for the user
        ///     nopass: Specify this user can login without a password.
        ///     resetpass: Reset all passwords defined for the user so far and disable passwordless login.
        /// </summary>
        /// <param name="input">A single line Redis-style ACL rule.</param>
        /// <param name="acl">An optional access control list to modify.</param>
        /// <returns>A user object representing the modified user.</returns>
        /// <exception cref="ACLParsingException">Thrown if the ACL rule cannot be parsed.</exception>
        /// <exception cref="ACLCategoryDoesNotExistException">Thrown if the ACL command category used by the operation does not exist.</exception>
        /// <exception cref="ACLUnknownOperationException">Thrown if the given operation does not exist.</exception>
        public static User ParseACLRule(string input, AccessControlList acl = null)
        {
            // Tokenize input string 
            string[] tokens = input.Trim().Split(WhitespaceChars, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);

            // Sanity check for correctness
            if (tokens.Length < 3)
            {
                throw new ACLParsingException("Malformed ACL rule");
            }

            // Expect keyword USER
            if (!tokens[0].Equals("user", StringComparison.OrdinalIgnoreCase))
            {
                throw new ACLParsingException("ACL rules need to start with the USER keyword");
            }

            // Expect username
            string username = tokens[1];

            // Retrieve/add the user with the username to the access control list, if provided
            User user;
            if (acl != null)
            {
                user = acl.GetUserHandle(username)?.User;

                if (user == null)

View on GitHub (pinned to 951b0fc683)

Solutions

1. Ensure each ACL rule line has at least: 'user <name> <one-op>'.
2. Use whitespace (space/tab) between tokens, not commas.
3. Validate the rule with a pre-flight tokenizer that asserts >= 3 tokens before parsing.
4. When loading from file, the Import loop wraps this in an ACLParsingException with file:line for easy location.

Example fix

// before
ACLParser.ParseACLRule("user alice");

// after
ACLParser.ParseACLRule("user alice on >password");

var tokens = input.Trim().Split(new[]{' ','\t','\r','\n'}, StringSplitOptions.RemoveEmptyEntries);
if (tokens.Length < 3) throw new ArgumentException("ACL rule needs >= 3 tokens: user <name> <op>");

static bool IsWellFormedRule(string input) =>
    input.Trim().Split(new[]{' ','\t','\r','\n'}, StringSplitOptions.RemoveEmptyEntries).Length >= 3;

try { ACLParser.ParseACLRule(line, acl); }
catch (ACLParsingException ex) { logger.LogError("Bad ACL line {File}:{Line}: {Msg}", ex.Filename, ex.Line, ex.Message); }

When it happens

Trigger: Passing a line like 'user' (1 token) or 'user alice' (2 tokens, no operation), or an empty/whitespace-only string after trim that somehow split to < 3 tokens; a config file line missing the operation clause.

Common situations: Hand-edited ACL config files with a truncated rule; a copy-paste that dropped the operations; a line that used a different delimiter (e.g. comma) instead of whitespace so it did not split into 3.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• ACL rules need to start with the USER keyword
• {categoryName}
• {commandName}
• {op}
• {exception.Message}

AI-assisted analysis of microsoft/garnet@951b0fc683 (2026-08-13). Data as JSON: /api/errors/53c58aef34dfa19b. Report an issue: GitHub.