{"record":{"id":"0e9f4b990b6ad01e","repo":"hyperledger/fabric","slug":"invalid-arguments","errorCode":null,"errorMessage":"invalid arguments","messagePattern":"invalid arguments","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/cauthdsl/policy.go","lineNumber":62,"sourceCode":"\t\treturn nil, nil, err\n\t}\n\n\treturn &policy{\n\t\tevaluator:               compiled,\n\t\tdeserializer:            pr.deserializer,\n\t\tsignaturePolicyEnvelope: sigPolicy,\n\t}, sigPolicy, nil\n}\n\n// EnvelopeBasedPolicyProvider allows to create a new policy from SignaturePolicyEnvelope struct instead of []byte\ntype EnvelopeBasedPolicyProvider struct {\n\tDeserializer msp.IdentityDeserializer\n}\n\n// NewPolicy creates a new policy from the policy envelope\nfunc (pp *EnvelopeBasedPolicyProvider) NewPolicy(sigPolicy *cb.SignaturePolicyEnvelope) (policies.Policy, error) {\n\tif sigPolicy == nil {\n\t\treturn nil, errors.New(\"invalid arguments\")\n\t}\n\n\tcompiled, err := compile(sigPolicy.Rule, sigPolicy.Identities)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &policy{\n\t\tevaluator:               compiled,\n\t\tdeserializer:            pp.Deserializer,\n\t\tsignaturePolicyEnvelope: sigPolicy,\n\t}, nil\n}\n\ntype policy struct {\n\tsignaturePolicyEnvelope *cb.SignaturePolicyEnvelope\n\tevaluator               func([]msp.Identity, []bool) bool\n\tdeserializer            msp.IdentityDeserializer","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/cauthdsl/policy.go#L44-L80","documentation":"Returned by EnvelopeBasedPolicyProvider.NewPolicy when the supplied SignaturePolicyEnvelope pointer is nil. This is a caller contract violation: the function accepts an already-deserialized policy envelope (unlike the byte-slice provider) and rejects a missing one before any compilation.","triggerScenarios":"Calling EnvelopeBasedPolicyProvider.NewPolicy(nil) — e.g. a caller that failed to fetch/decode the envelope upstream and forwards nil without checking.","commonSituations":"Lookup of a policy envelope that does not exist returns nil and the caller passes it straight through; refactored code paths dropping an earlier nil check.","solutions":["Check the envelope for nil before calling NewPolicy","Fix the upstream producer so it returns an error instead of nil,enil when the envelope cannot be obtained"],"exampleFix":"// before\npolicy, err := pp.NewPolicy(maybeNilEnvelope) // panics/errors on nil\n// after\nif maybeNilEnvelope == nil {\n    return nil, errors.New(\"policy envelope not found\")\n}\npolicy, err := pp.NewPolicy(maybeNilEnvelope)","handlingStrategy":"type-guard","validationCode":"if sigPolicy == nil {\n    return errors.New(\"cannot build policy: envelope is nil\")\n}","typeGuard":"func hasEnvelope(env *cb.SignaturePolicyEnvelope) bool { return env != nil }","tryCatchPattern":"policy, err := pp.NewPolicy(env)\nif err != nil {\n    if err.Error() == \"invalid arguments\" {\n        return fmt.Errorf(\"no envelope provided for policy %q\", id)\n    }\n    return err\n}","preventionTips":["Never forward a nil envelope from a failed lookup; return an error instead","Make EnvelopeBasedPolicyProvider callers construct envelopes at a single choke point","Add a nil-envelope unit test for every policy construction path"],"tags":["policy","nil-argument","validation"],"backgroundTag":"nil-argument","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}