pentaho/pentaho-kettle · warning · IllegalArgumentException

Potential code injection detected in

Error message

Potential code injection detected in %s: %s

What it means

AvroSchemaValidator.checkForInjectionPatterns scans schema content strings against a list of suspicious regex patterns (code-injection signatures) and throws this IllegalArgumentException naming the offending field when a pattern matches. This is a security guard against malicious Avro schemas that embed executable-looking payloads.

Solutions

  1. The message names the field (%s) — inspect that field's value and remove/escape the pattern-matching content.
  2. If the match is a false positive in a trusted schema, rephrase the field value (e.g. remove lookalike code snippets from doc strings).
  3. Only accept schemas from trusted sources; never build schema JSON by concatenating raw user input.
  4. Review the INJECTION_PATTERNS list to understand which exact pattern matched and why.

Example fix

// before
{"name": "f", "doc": "use eval(payload) to decode"}
// after
{"name": "f", "doc": "decodes the payload"}
Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-scan schema text with your own copy of the forbidden patterns before submitting
java.util.regex.Pattern P = java.util.regex.Pattern.compile("(?i)(eval|exec|script\\s*:)");
if (P.matcher(schemaString).find()) throw new IllegalArgumentException("Schema contains suspicious content");

Try / catch

try {
  AvroSchemaValidator.validateSchema(schemaString);
} catch (IllegalArgumentException e) {
  if (e.getMessage().startsWith("Potential code injection detected")) {
    String field = e.getMessage().split(":")[0].replace("Potential code injection detected in ", "").trim();
    logger.warn("Suspicious content in schema field: " + field);
  }
  throw e;
}

Prevention

When it happens

Trigger: A schema field value (checked via validateSchemaNode → checkForInjectionPatterns) matches one of the INJECTION_PATTERNS regexes — e.g. strings containing script/exec/eval-like constructs or template injection signatures.

Common situations: Schemas from untrusted third parties containing suspicious strings; legitimate field names/docs/comments that accidentally match a pattern (false positive); a schema built by string-concatenating untrusted user input.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/362016e80d89dc95. Report an issue: GitHub.

Appendix: source

Thrown at plugins/avro-format/core/src/main/java/org/pentaho/di/trans/steps/avro/AvroSchemaValidator.java:119

    }
  }

  /**
   * Checks a string for injection patterns.
   * 
   * @param content the content to check
   * @param fieldName the name of the field being checked (for error messages)
   * @throws IllegalArgumentException if injection patterns are found
   */
  private static void checkForInjectionPatterns(String content, String fieldName) 
      throws IllegalArgumentException {
    if (content == null || content.isEmpty()) {
      return;
    }

    for (Pattern pattern : INJECTION_PATTERNS) {
      if (pattern.matcher(content).find()) {
        throw new IllegalArgumentException(
          String.format("Potential code injection detected in %s: %s", fieldName, 
            "schema contains suspicious code patterns"));
      }
    }
  }

  /**
   * Sanitizes a schema by removing or neutralizing suspicious patterns.
   * This is a more lenient approach than strict validation.
   * 
   * @param schemaString the schema JSON string to sanitize
   * @return the sanitized schema string
   */
  public static String sanitizeSchema(String schemaString) {
    if (schemaString == null || schemaString.isEmpty()) {
      return schemaString;
    }

View on GitHub (pinned to f3058517a1)