{"record":{"id":"188ce95a8aa91de2","repo":"quarkusio/quarkus","slug":"target-roles-for-role-s-must-not-be-null","errorCode":null,"errorMessage":"Target roles for role '%s' must not be null","messagePattern":"Target roles for role '(.+?)' must not be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":263,"sourceCode":"                    throw new IllegalArgumentException(\"Source role must not be empty\");\n                }\n                if (targetRoles == null || targetRoles.isEmpty()) {\n                    throw new IllegalArgumentException(\"Target roles for role '%s' must not be empty\".formatted(sourceRole));\n                }\n            }\n        });\n\n        this.rolesMapping = RolesMapping.of(roleToRoles);\n        return this;\n    }\n\n    @Override\n    public HttpSecurity rolesMapping(String sourceRole, List<String> targetRoles) {\n        if (sourceRole == null) {\n            throw new IllegalArgumentException(\"Source role must not be null\");\n        }\n        if (targetRoles == null) {\n            throw new IllegalArgumentException(\"Target roles for role '%s' must not be null\".formatted(sourceRole));\n        }\n        return rolesMapping(Map.of(sourceRole, targetRoles));\n    }\n\n    @Override\n    public HttpSecurity rolesMapping(String sourceRole, String targetRole) {\n        if (targetRole == null) {\n            throw new IllegalArgumentException(\"Target role for role '%s' must not be null\".formatted(sourceRole));\n        }\n        return rolesMapping(sourceRole, List.of(targetRole));\n    }\n\n    void addHttpPermissions(List<HttpPermissionCarrier> httpPermissions) {\n        this.httpPermissions.addAll(httpPermissions);\n    }\n\n    private final class AuthorizationPolicy implements Authorization {\n","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L245-L281","documentation":"The same single-entry overload rejects a null target-roles list with an IllegalArgumentException formatted with the source role name. Target roles are the replacement/granted roles, so a null list would make the mapping entry unusable. Note that even a non-null list still goes through the Map-based overload, which rejects empty lists.","triggerScenarios":"rolesMapping(\"user\", null); passing a List<String> variable that was never populated; a config accessor returning null for an optional roles list that is then forwarded directly.","commonSituations":"Programmatic security wiring where target roles come from optional config; mapping an identity-provider role to application roles where the mapping table entry was missing; test scaffolding that forgot to set the list.","solutions":["Provide a non-empty List.of(...) of target roles for the mapping.","Skip the rolesMapping call when the configured target list is absent.","Check that the accessor feeding the list returns an empty list rather than null for missing config."],"exampleFix":"// before\nhttpSecurity.rolesMapping(\"user\", config.targetRoles()); // may be null\n// after\nList<String> targets = config.targetRoles();\nif (targets != null && !targets.isEmpty()) {\n    httpSecurity.rolesMapping(\"user\", targets);\n}","handlingStrategy":"validation","validationCode":"if (targetRoles != null && !targetRoles.isEmpty()) {\n    httpSecurity.rolesMapping(sourceRole, targetRoles);\n}","typeGuard":"static boolean hasTargets(List<String> targetRoles) {\n    return targetRoles != null && !targetRoles.isEmpty();\n}","tryCatchPattern":"try {\n    httpSecurity.rolesMapping(\"user\", targets);\n} catch (IllegalArgumentException e) {\n    log.error(\"Invalid target roles: \" + e.getMessage());\n}","preventionTips":["Have config accessors return List.of() instead of null for missing lists.","Build target lists eagerly with List.of(...) at the call site.","Cover the mapping code path with a test asserting no null lists are produced."],"tags":["quarkus","http-security","role-mapping","null-check","argument-validation"],"backgroundTag":"null-argument-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}