NationalSecurityAgency/ghidra · error · LSHException

Missing username for password change

Error message

Missing username for password change

What it means

Thrown by PostgresFunctionDatabase.fdbPasswordChange() when the PasswordChange request's username field is null. The password change operation requires a target user; a null username indicates the request was not properly populated before being sent to the server.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/PostgresFunctionDatabase.java:613

		response.success = true;
	}

	/**
	 * Entry point for the PrewarmRequest command
	 * @param request the prewarm request
	 * @param c Postgres DB connection
	 * @throws SQLException if there is an error issuing the query
	 */
	private void fdbPrewarm(PrewarmRequest request, Connection c) throws SQLException {
		ResponsePrewarm response = request.prewarmresponse;
		response.blockCount = preWarm(c, request.mainIndexConfig, request.secondaryIndexConfig,
			request.vectorTableConfig);
	}

	private void fdbPasswordChange(PasswordChange query, Connection c) throws LSHException {
		ResponsePassword response = query.passwordResponse;
		if (query.username == null) {
			throw new LSHException("Missing username for password change");
		}
		if (query.newPassword == null || query.newPassword.length == 0) {
			throw new LSHException("No password provided");
		}
		response.changeSuccessful = true;		// Response parameters assuming success
		response.errorMessage = null;
		try {
			changePassword(c, query.username, query.newPassword);
		}
		catch (SQLException e) {
			response.changeSuccessful = false;
			response.errorMessage = e.getMessage();
		}
	}

	@Override
	public String formatBitAndSQL(String v1, String v2) {
		return "(" + v1 + " & " + v2 + ")";

View on GitHub (pinned to d5f144c24d)

Solutions

1. Always set PasswordChange.username before submitting the query.
2. Validate the request fields client-side before calling doQuery().
3. If parsing XML requests, ensure the username attribute is present and non-null.

Example fix

// before
PasswordChange q = new PasswordChange();
q.newPassword = newPass.toCharArray();
// username is null
db.doQuery(q, conn); // throws "Missing username for password change"

// after
PasswordChange q = new PasswordChange();
q.username = targetUser;
q.newPassword = newPass.toCharArray();
db.doQuery(q, conn);

if (query.username == null || query.username.isEmpty()) {
    throw new IllegalArgumentException("username is required for password change");
}
db.doQuery(query, conn);

public static boolean isPasswordChangeValid(PasswordChange q) {
    return q.username != null && !q.username.isEmpty()
        && q.newPassword != null && q.newPassword.length > 0;
}

try {
    db.doQuery(query, conn);
} catch (LSHException e) {
    if (e.getMessage().contains("Missing username")) {
        // prompt for / set username, then retry
        throw e;
    }
    throw e;
}

When it happens

Trigger: Submitting a PasswordChange query via doQuery() where the username field was never set (it defaults to null in the constructor). This happens when the caller constructs a PasswordChange object but only sets newPassword, omitting the username, or when deserializing a malformed request that lacks the username attribute.

Common situations: Client code builds a PasswordChange request but forgets to set username. An XML request was received (via restoreXml) that omits the username attribute. The username was set to null intentionally or by a logic error.

Related errors

• No password provided
• PKI authentication requested, but certificate authority file
• Distinguished name option (--dn) required for {}
• Error copying original connection file
• Error creating new user

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/8c2665c059116e4b. Report an issue: GitHub.