added +

Author: smiklosovic

src/java/org/apache/cassandra/db/ColumnFamilyStore.java

@@ -1899,10 +1899,12 @@ private void validateSnapshotName(String snapshotName)
         // Allowed characters are a conservative subset of the AWS S3 "Safe characters" set
         // (https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-guidelines):
         //   0-9  a-z  A-Z  -  _  .
+        // plus '+', which is not an S3 "Safe character" but can legitimately appear in system
+        // snapshot names via version build metadata (e.g. an upgrade snapshot "<millis>-upgrade-5.0.4+build-...").
         // The remaining S3-safe characters (! * ' ( )) are intentionally excluded as they are
         // shell-significant and error-prone in paths, and the path separator '/' is excluded too,
         // which is what blocks traversal attempts such as "../../mysnapshot"
-        if (!Pattern.compile("[a-zA-Z0-9_.-]+").matcher(snapshotName).matches())
+        if (!Pattern.compile("[a-zA-Z0-9_.+-]+").matcher(snapshotName).matches())
         {
             throw new IllegalArgumentException("Snapshot name contains illegal characters: " + snapshotName);
         }

test/unit/org/apache/cassandra/db/SnapshotTest.java

@@ -78,6 +78,10 @@ public void testSnapshotNameValidation()
             // Dots embedded in a name are not traversal: with '/' excluded, "a..tag" is just a literal directory.
             assertThatCode(() -> cfs.snapshot("a..tag")).doesNotThrowAnyException();
 
+            // "+" is part of the allowed set because it can appear in a Cassandra version
+            // (build metadata, e.g. "7.0.0+abc123"), which ends up in system snapshot names.
+            assertThatCode(() -> cfs.snapshot("this_is_snapshot-7.0.0+abc123")).doesNotThrowAnyException();
+
             String tooLong = repeat('a', SchemaConstants.FILENAME_LENGTH + 1);
             assertThatThrownBy(() -> cfs.snapshot(tooLong))
             .isInstanceOf(IllegalArgumentException.class)