{"record":{"id":"0449bee1f42ae598","repo":"spring-projects/spring-security","slug":"invalid-item-item-getclass","errorCode":null,"errorMessage":"invalid item: \" + item.getClass()","messagePattern":"invalid item: \" \\+ item\\.getClass\\(\\)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/core/ComparableVersion.java","lineNumber":269,"sourceCode":"\t\t}\n\n\t\t@Override\n\t\tpublic boolean isNull() {\n\t\t\treturn BigInteger.ZERO.equals(value);\n\t\t}\n\n\t\t@Override\n\t\tpublic int compareTo(@Nullable Item item) {\n\t\t\tif (item == null) {\n\t\t\t\treturn BigInteger.ZERO.equals(value) ? 0 : 1; // 1.0 == 1, 1.1 > 1\n\t\t\t}\n\n\t\t\treturn switch (item.getType()) {\n\t\t\t\tcase INT_ITEM, LONG_ITEM -> 1;\n\t\t\t\tcase BIGINTEGER_ITEM -> value.compareTo(((BigIntegerItem) item).value);\n\t\t\t\tcase STRING_ITEM -> 1; // 1.1 > 1-sp\n\t\t\t\tcase LIST_ITEM -> 1; // 1.1 > 1-1\n\t\t\t\tdefault -> throw new IllegalStateException(\"invalid item: \" + item.getClass());\n\t\t\t};\n\t\t}\n\n\t\t@Override\n\t\tpublic boolean equals(@Nullable Object o) {\n\t\t\tif (this == o) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (o == null || getClass() != o.getClass()) {\n\t\t\t\treturn false;\n\t\t\t}\n\n\t\t\tBigIntegerItem that = (BigIntegerItem) o;\n\n\t\t\treturn value.equals(that.value);\n\n\t\t}\n","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/core/ComparableVersion.java#L251-L287","documentation":"ComparableVersion's BigIntegerItem.compareTo throws IllegalStateException('invalid item: ' + item.getClass()) when a BigInteger version item meets a type not covered by its switch branch (only INT, LONG, BIGINTEGER, STRING, LIST are handled). Hitting default indicates the comparison matrix between parsed item types was violated — an internal invariant of ComparableVersion.","triggerScenarios":"Comparing versions whose numeric segments overflow to BigInteger against exotic qualifier items produced by a different parser or patched copy; programmatic construction of item lists bypassing ComparableVersion's own parser.","commonSituations":"Maven-style version strings with astronomically large numeric parts; classpath containing multiple divergent copies of ComparableVersion (shaded jars) so items from one copy are compared by another with a different switch.","solutions":["Remove duplicate/shaded copies of ComparableVersion from the classpath so a single consistent implementation parses and compares items","Keep numeric version segments within long range to avoid BigInteger items entirely","Upgrade to the fixed Spring Security release where cross-type comparisons are complete","Catch IllegalStateException around comparisons of untrusted version strings and fall back to lexicographic comparison"],"exampleFix":"// before\nnew ComparableVersion(\"999999999999999999999999999999\").compareTo(other) // BigIntegerItem path\n// after\nnew ComparableVersion(\"1.0.0\").compareTo(other) // bounded numeric segments","handlingStrategy":"fallback","validationCode":"if (version.matches(\".*\\\\d{30,}.*\")) { throw new IllegalArgumentException(\"numeric version segment too large: \" + version); }","typeGuard":null,"tryCatchPattern":"int cmp; try { cmp = new ComparableVersion(a).compareTo(new ComparableVersion(b)); } catch (IllegalStateException e) { cmp = a.compareTo(b); }","preventionTips":["Avoid versions with numeric segments exceeding long range so BigInteger items are never produced","Exclude duplicate shaded copies of ComparableVersion from the classpath","Wrap third-party version comparisons in a safe comparator with a string-comparison fallback"],"tags":["versioning","comparable-version","illegal-state","classpath"],"backgroundTag":"internal-invariant-violation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}