apereo/cas · warning

Pattern cannot be null/blank

Error message

Pattern cannot be null/blank

What it means

RegexUtils.createPattern(String, int) is null-tolerant by design: when the given pattern string is null or blank it logs a warning and returns MATCH_NOTHING_PATTERN (a regex that matches nothing) instead of throwing a NullPointerException. This lets CAS configuration omit optional regex settings safely, but callers who expected a real pattern will see all matches fail silently.

Solutions

1. Provide a valid regex value for the configuration property that feeds createPattern
2. If the pattern is genuinely optional, code defensively against MATCH_NOTHING_PATTERN semantics (no matches) rather than treating absence as 'match all'
3. Check for placeholder/variable resolution that silently yields an empty string (e.g. ${VAR} with VAR unset)

Example fix

// before (yml)
cas:
  authn:
    pattern: ""   # results in MATCH_NOTHING_PATTERN
// after
cas:
  authn:
    pattern: "^(user1|user2)$"

String pattern = properties.getPattern();
if (pattern == null || pattern.isBlank()) {
    throw new IllegalArgumentException("pattern property must be a non-blank regex");
}
Pattern compiled = RegexUtils.createPattern(pattern);

static boolean isUsablePattern(String p) {
    return p != null && !p.isBlank() && RegexUtils.createPattern(p) != RegexUtils.MATCH_NOTHING_PATTERN;
}

When it happens

Trigger: Passing null, empty, or whitespace-only strings to RegexUtils.createPattern(...), typically from a cas.* regex configuration property that was left unset or cleared. Invalid regexes take a different path (debug log + MATCH_NOTHING_PATTERN after PatternSyntaxException).

Common situations: A regex-based service attribute filter or access strategy property left blank in config; an installer not prompting for an optional pattern; property placeholder resolving to empty string.

Related errors

• No user can be accepted because none is defined
• Not all requested multifactor providers could be found…
• Cookie name is undefined
• List of candidate multifactor authentication providers is…
• Principal id attribute is not found for [principalAttr]

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/98bdf4c29b60c1ab. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/RegexUtils.java:93

     *
     * @param pattern the pattern, may not be null.
     * @return the pattern or {@link RegexUtils#MATCH_NOTHING_PATTERN}
     * if pattern is null or invalid.
     */
    public static Pattern createPattern(@Nullable final String pattern) {
        return createPattern(pattern, Pattern.CASE_INSENSITIVE);
    }

    /**
     * Creates the pattern with the given flags.
     *
     * @param pattern the pattern, may be null.
     * @param flags   the flags
     * @return the compiled pattern or {@link RegexUtils#MATCH_NOTHING_PATTERN} if pattern is null or invalid.
     */
    public static Pattern createPattern(@Nullable final String pattern, final int flags) {
        if (StringUtils.isBlank(pattern)) {
            LOGGER.warn("Pattern cannot be null/blank");
            return MATCH_NOTHING_PATTERN;
        }
        try {
            return computePattern(pattern, flags);
        } catch (final PatternSyntaxException exception) {
            LOGGER.debug("Pattern [{}] is not a valid regex.", pattern);
            return MATCH_NOTHING_PATTERN;
        }
    }

    /**
     * Matches the entire region for the string.
     *
     * @param pattern the pattern
     * @param value   the string
     * @return true/false
     * @see Matcher#matches()
     */

View on GitHub (pinned to e7288fc434)