NationalSecurityAgency/ghidra · error · LSHException

No password provided

Error message

No password provided

What it means

Thrown by ElasticDatabase.fdbPasswordChange when a PasswordChange command is submitted whose newPassword field is null or a zero-length char array. It is a pure client-side validation of the request payload before any network call to Elasticsearch is made; the username is validated separately just above. The check exists because an empty password cannot be used to change PostgreSQL/Elastic user credentials.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java:3423

		}
		catch (ElasticException e) {
			response.dropSuccessful = false;
			response.errorMessage = e.getMessage();
		}
	}

	/**
	 * Entry point for the Elasticsearch version of PasswordChange command.
	 * @param query is command parameters
	 * @throws LSHException if details of the request are malformed
	 */
	private void fdbPasswordChange(PasswordChange query) throws LSHException {
		ResponsePassword response = query.passwordResponse;
		if (query.username == null) {
			throw new LSHException("Missing username for password change");
		}
		if (query.newPassword == null || query.newPassword.length == 0) {
			throw new LSHException("No password provided");
		}
		response.changeSuccessful = true;		// Response parameters assuming success
		response.errorMessage = null;
		try {
			changePasswordInternal(query.username, query.newPassword);
		}
		catch (ElasticException ex) {
			response.changeSuccessful = false;
			response.errorMessage = ex.getMessage();
		}
		query.clearPassword();
	}

	/**
	 * Given the document id for a specific function. Query for the document and
	 * produce the corresponding FunctionDescription
	 * @param manager is the container for the new FunctionDescription
	 * @param rowId is the document id of the function

View on GitHub (pinned to d5f144c24d)

Solutions

1. Validate the password char array is non-null and length > 0 before building the PasswordChange command.
2. If prompting a user, reject an empty entry in the dialog/prompt layer and re-ask, so the command never carries an empty password.
3. When wrapping changePassword in a service, surface a clear 'Password required' UI message rather than letting the LSHException escape.

Example fix

// before
PasswordChange cmd = new PasswordChange();
cmd.username = user;
cmd.newPassword = entered; // entered may be null
// after
if (entered == null || entered.length == 0) {
    throw new IllegalArgumentException("Password required");
}
PasswordChange cmd = new PasswordChange();
cmd.username = user;
cmd.newPassword = entered;

// before constructing PasswordChange
if (newPassword == null || newPassword.length == 0) {
    throw new IllegalArgumentException("Password required");
}
PasswordChange cmd = new PasswordChange();
cmd.username = username;
cmd.newPassword = newPassword;

static boolean hasUsablePassword(char[] pw) {
    return pw != null && pw.length > 0;
}

try {
    passwordChange.execute(database);
} catch (LSHException e) {
    if (e.getMessage().contains("No password provided")) {
        // re-prompt the user for a password
    } else {
        throw e;
    }
}

When it happens

Trigger: Constructing a PasswordChange (or calling SimilarFunctionQueryService.changePassword) with newPassword == null or new char[0]. Also firing a raw PasswordChange BSimQuery against an ElasticDatabase whose .newPassword was never assigned.

Common situations: A GUI/script password-change flow whose input dialog returned empty; a char[] whose contents were cleared (Arrays.fill) before being passed in; a unit test stubbing the password to null.

Related errors

• Function list cannot be null
• Function list cannot be empty
• Function list cannot be null
• Function list cannot be empty
• {getType()}scripts cannot be used for context [{context.name

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/9a79c6e2e9bdfd41. Report an issue: GitHub.