{"record":{"id":"119477a30366337e","repo":"grpc/grpc-java","slug":"values-is-absent-or-empty","errorCode":null,"errorMessage":"\"values\" is absent or empty","messagePattern":"\"values\" is absent or empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java","lineNumber":86,"sourceCode":"            Authenticated.newBuilder().setPrincipalName(\n              getStringMatcher(principal)).build()).build());\n    }\n    return Principal.newBuilder().setOrIds(principalsSet.build()).build();\n  }\n\n  private static Permission parseHeader(Map<String, ?> header) throws IllegalArgumentException {\n    String key = JsonUtil.getString(header, \"key\");\n    if (key == null || key.isEmpty()) {\n      throw new IllegalArgumentException(\"\\\"key\\\" is absent or empty\");\n    }\n    if (key.charAt(0) == ':'\n        || key.startsWith(\"grpc-\")\n        || UNSUPPORTED_HEADERS.contains(key.toLowerCase(Locale.ROOT))) {\n      throw new IllegalArgumentException(String.format(\"Unsupported \\\"key\\\" %s\", key));\n    }\n    List<String> valuesList = JsonUtil.getListOfStrings(header, \"values\");\n    if (valuesList == null || valuesList.isEmpty()) {\n      throw new IllegalArgumentException(\"\\\"values\\\" is absent or empty\");\n    }\n    Permission.Set.Builder orSet = Permission.Set.newBuilder();\n    for (String value: valuesList) {\n      orSet.addRules(\n          Permission.newBuilder().setHeader(\n            HeaderMatcher.newBuilder()\n            .setName(key)\n            .setStringMatch(getStringMatcher(value)).build()).build());     \n    }\n    return Permission.newBuilder().setOrRules(orSet.build()).build();\n  }\n\n  private static Permission parseRequest(Map<String, ?> request) throws IllegalArgumentException {\n    Permission.Set.Builder andSet = Permission.Set.newBuilder();\n    List<String> pathsList = JsonUtil.getListOfStrings(request, \"paths\"); \n    if (pathsList != null && !pathsList.isEmpty()) {\n      Permission.Set.Builder pathsSet = Permission.Set.newBuilder();\n      for (String path: pathsList) {           ","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java#L68-L104","documentation":"parseHeader requires each header rule to carry a non-empty \"values\" list alongside the key. If \"values\" is missing, null, or an empty list, there is nothing to match against and the translation of the authorization policy fails with IllegalArgumentException.","triggerScenarios":"A policy JSON rule has {\"key\":\"x-user-group\"} with no \"values\" array, or \"values\": [] — including when the JSON writer omitted the field for optional-looking rules.","commonSituations":"Template-generated policies with unfilled value arrays; rules cloned and values stripped; JSON where values were expected at a different nesting level.","solutions":["Add a non-empty \"values\" array of strings to every headers entry","Remove rules that genuinely have no values","Validate the policy schema before translation","Ensure values are strings, not numbers/objects (getListOfStrings would also fail)"],"exampleFix":"// before\n{\"headers\":[{\"key\":\"x-user-group\",\"values\":[]}]}\n// after\n{\"headers\":[{\"key\":\"x-user-group\",\"values\":[\"admin\",\"editor\"]}]}","handlingStrategy":"validation","validationCode":"static void checkHeaderValues(Map<String, ?> rule) {\n  List<String> values = JsonUtil.getListOfStrings(rule, \"values\");\n  if (values == null || values.isEmpty()) throw new IllegalArgumentException(\"header rule missing \\\"values\\\"\");\n}","typeGuard":null,"tryCatchPattern":"try { AuthorizationPolicyTranslator.translate(policyJson, serverName); } catch (IllegalArgumentException e) { throw new PolicyValidationException(\"Policy header rule has no values: \" + e.getMessage(), e); }","preventionTips":["Always pair \"key\" with a non-empty \"values\" array","Ensure values are strings, not numbers/objects","Validate policy JSON in CI before deployment","Remove rules with no meaningful values"],"tags":["grpc","authz","json-policy","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}