{"record":{"id":"1bb6eec15f3c6259","repo":"XTLS/Xray-core","slug":"empty-password-1bb6ee","errorCode":null,"errorMessage":"empty password","messagePattern":"empty password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/transport_finalmask.go","lineNumber":767,"sourceCode":"\tif c.TexturesValue == \"\" || c.TexturesSignature == \"\" {\n\t\treturn nil, fmt.Errorf(\"incomplete minecraft profile textures\")\n\t}\n\n\treturn &xmc.Profile{\n\t\tUsername:          c.Username,\n\t\tUuid:              append([]byte(nil), profileUUID[:]...),\n\t\tTexturesValue:     c.TexturesValue,\n\t\tTexturesSignature: c.TexturesSignature,\n\t}, nil\n}\n\nfunc (c *XMC) Build() (proto.Message, error) {\n\tif len(c.Profiles) == 0 {\n\t\treturn nil, fmt.Errorf(\"minecraft profiles are required\")\n\t}\n\n\tif c.Password == \"\" {\n\t\treturn nil, fmt.Errorf(\"empty password\")\n\t}\n\n\trsaPrivateKey, err := xmc.DeriveRSAKey(c.Password)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"derive minecraft rsa key: %w\", err)\n\t}\n\n\trsaPublicKey, err := x509.MarshalPKIXPublicKey(&rsaPrivateKey.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"marshal minecraft rsa public key: %w\", err)\n\t}\n\n\tprofiles := make([]*xmc.Profile, 0, len(c.Profiles))\n\tfor i := range c.Profiles {\n\t\tprofile, err := c.Profiles[i].Build()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"build minecraft profile %d: %w\", i, err)\n\t\t}","sourceCodeStart":749,"sourceCodeEnd":785,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/transport_finalmask.go#L749-L785","documentation":"XMC.Build requires a non-empty password because the RSA key pair used by the Minecraft masking layer is deterministically derived from it (xmc.DeriveRSAKey). An empty password would yield a known, public key pair and is rejected outright.","triggerScenarios":"Omitting \"password\" in the xmc settings block or setting it to \"\".","commonSituations":"Placeholder configs with an empty password meant to be filled later; password key typo (pass/pwd) leaving the field zero-valued.","solutions":["Set a strong non-empty password shared by both client and server xmc configs","Verify the exact JSON key \"password\" is used","Keep the password identical on both ends — the derived RSA keys must match"],"exampleFix":"// before\n\"xmc\": { \"password\": \"\", \"profiles\": [ ... ] }\n\n// after\n\"xmc\": { \"password\": \"a-long-shared-secret\", \"profiles\": [ ... ] }","handlingStrategy":"validation","validationCode":"func validXmcPassword(pw string) bool { return pw != \"\" }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat xmc password as required metadata in config templates","Use the same strong password on both peers"],"tags":["xmc","minecraft","config","password"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}