SonarSource/sonarqube · error · IllegalArgumentException

Unknown severity: %s

Error message

Unknown severity: %s

What it means

RuleActivation's constructor validates that an optional severity string is one of the values in Severity.ALL (INFO, MINOR, MAJOR, CRITICAL, BLOCKER) and throws IllegalArgumentException otherwise. It guards against malformed severity values when activating/deactivating a rule in a quality profile.

Source

Thrown at server/sonar-webserver-api/src/main/java/org/sonar/server/qualityprofile/RuleActivation.java:53

@Immutable
public class RuleActivation {

  private final String ruleUuid;
  private final boolean reset;
  private final String severity;
  private final Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> impactSeverities;
  private final Boolean prioritizedRule;
  private final Map<String, String> parameters = new HashMap<>();

  private RuleActivation(String ruleUuid, boolean reset, @Nullable String severity, @Nullable Boolean prioritizedRule, @Nullable Map<String, String> parameters,
    Map<SoftwareQuality, org.sonar.api.issue.impact.Severity> impactSeverities) {
    this.ruleUuid = ruleUuid;
    this.reset = reset;
    this.severity = severity;
    this.prioritizedRule = prioritizedRule;
    this.impactSeverities = impactSeverities.isEmpty() ? Map.of() : new EnumMap<>(impactSeverities);
    if (severity != null && !Severity.ALL.contains(severity)) {
      throw new IllegalArgumentException("Unknown severity: " + severity);
    }
    if (parameters != null) {
      for (Map.Entry<String, String> entry : parameters.entrySet()) {
        this.parameters.put(entry.getKey(), Strings.emptyToNull(entry.getValue()));
      }
    }
  }

  public static RuleActivation createReset(String ruleUuid) {
    return new RuleActivation(ruleUuid, true, null, null, null, Map.of());
  }

  public static RuleActivation create(String ruleUuid, @Nullable String severity, @Nullable Boolean prioritizedRule,
    @Nullable Map<String, String> parameters) {
    return new RuleActivation(ruleUuid, false, severity, prioritizedRule, parameters, Map.of());
  }

  public static RuleActivation create(String ruleUuid, @Nullable String severity, @Nullable Map<SoftwareQuality,

View on GitHub (pinned to 184c821202)

Solutions

1. Pass only Severity.ALL values (INFO, MINOR, MAJOR, CRITICAL, BLOCKER) or null for default severity
2. Normalize/validate input with Severity.ALL.contains(severity) before constructing RuleActivation
3. Use the Severity.ALL constant as the source of truth instead of hardcoding strings

Example fix

// before
new RuleActivation(ruleUuid, reset, "major", prioritizedRule, impactSeverities, parameters);
// after
String severity = request.severity();
if (severity != null && !Severity.ALL.contains(severity)) {
  throw new BadRequestException("Invalid severity: " + severity);
}
new RuleActivation(ruleUuid, reset, severity.toUpperCase(Locale.ROOT), prioritizedRule, impactSeverities, parameters);

if (severity != null && !Severity.ALL.contains(severity)) {
  throw new BadRequestException("severity must be one of " + Severity.ALL + ", got: " + severity);
}

String normalizeSeverity(String s) {
  if (s == null) return null;
  String upper = s.trim().toUpperCase(Locale.ROOT);
  return Severity.ALL.contains(upper) ? upper : null; // null signals invalid
}

try {
  new RuleActivation(ruleUuid, reset, severity, prioritizedRule, impacts, params);
} catch (IllegalArgumentException e) {
  if (!e.getMessage().startsWith("Unknown severity")) throw e;
  // reject request with 400 and list valid severities
}

When it happens

Trigger: Constructing new RuleActivation(...) with a severity string that is null-checkable but not in Severity.ALL — e.g. arbitrary user input, lowercase 'major', legacy values like 'INFO ' with whitespace, or API payloads with invalid severity.

Common situations: Quality-profile activation requests built from unvalidated request parameters; clients sending custom severities; case sensitivity mistakes ('critical' vs 'CRITICAL').

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Message '%s' cannot be dismissed.
• Backup XML is not valid. Root element must be <profile>.
• a JVM option can't be empty and must start with '-'. The fol
• Command-line argument must start with -D, for example -Dsona
• Bad format of JDBC URL: %s

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/e9ff11385d2fd588. Report an issue: GitHub.