{"record":{"id":"2464e5a3890d41a4","repo":"quarkusio/quarkus","slug":"permission-value-must-not-be-empty","errorCode":null,"errorMessage":"Permission value must not be empty","messagePattern":"Permission value must not be empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/PermissionToActionUtil.java","lineNumber":23,"sourceCode":"    public sealed interface ParsedPermission {\n        String name();\n\n        String action();\n\n        default boolean hasAction() {\n            return action() != null;\n        }\n    }\n\n    record ParsedPermissionImpl(String name, String action) implements ParsedPermission {\n    }\n\n    private PermissionToActionUtil() {\n    }\n\n    public static ParsedPermission parse(String raw) {\n        if (raw.isEmpty()) {\n            throw new IllegalArgumentException(\"Permission value must not be empty\");\n        }\n\n        var name = new StringBuilder();\n        var action = new StringBuilder();\n        boolean foundSeparator = false;\n        char[] chars = raw.toCharArray();\n\n        for (int i = 0; i < chars.length; i++) {\n            switch (chars[i]) {\n                case '\\\\':\n                    if (++i == chars.length || chars[i] != ':') {\n                        throw new IllegalArgumentException(\n                                \"Invalid escape sequence in permission value '\" + raw\n                                        + \"': backslash is only allowed before a colon (\\\\:)\");\n                    }\n                    if (foundSeparator) {\n                        action.append(':');\n                    } else {","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/PermissionToActionUtil.java#L5-L41","documentation":"PermissionToActionUtil.parse() converts a raw config string of the form 'permission-class:action' into a ParsedPermission. It rejects an empty string because no permission class name can be derived from it. This guards the security permission configuration parsing.","triggerScenarios":"Configuring a security permission entry whose value is an empty string — a property declared with a key but no value, or a placeholder resolving to ''.","commonSituations":"An application.properties line like my-permission= with nothing after '='; YAML keys with null/empty values; build-time property placeholders resolving to empty string in security permission configuration.","solutions":["Set a non-empty permission value of the form 'com.example.MyPermission:action' (or 'com.example.MyPermission' for no-arg permissions).","Remove the empty property entry entirely if the permission is not needed.","Check for placeholder expressions (e.g. ${env.VAR}) that resolve to an empty value and provide a default."],"exampleFix":"# before\nmy-permission=\n\n# after\nmy-permission=com.example.MyPermission:read","handlingStrategy":"validation","validationCode":"String raw = configValue;\nif (raw == null || raw.isEmpty()) {\n    throw new IllegalArgumentException(\"Provide 'PermissionClass[:action]'\");\n}","typeGuard":null,"tryCatchPattern":"try { PermissionToActionUtil.parse(raw); } catch (IllegalArgumentException e) { /* fix empty value */ }","preventionTips":["Always provide full 'ClassName:action' values in permission config","Delete unused permission properties rather than leaving them empty","Check placeholder resolution (${env.X}) provides non-empty defaults"],"tags":["security","configuration","permissions"],"backgroundTag":"security-permission-config-invalid","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}