{"record":{"id":"28fd339a22b0d229","repo":"apache/hadoop","slug":"secretprovider-cannot-be-null","errorCode":null,"errorMessage":"secretProvider cannot be NULL","messagePattern":"secretProvider cannot be NULL","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/Signer.java","lineNumber":42,"sourceCode":"\n/**\n * Signs strings and verifies signed strings using a SHA digest.\n */\npublic class Signer {\n  private static final String SIGNATURE = \"&s=\";\n  private static final String SIGNING_ALGORITHM = \"HmacSHA256\";\n\n  private SignerSecretProvider secretProvider;\n\n  /**\n   * Creates a Signer instance using the specified SignerSecretProvider.  The\n   * SignerSecretProvider should already be initialized.\n   *\n   * @param secretProvider The SignerSecretProvider to use\n   */\n  public Signer(SignerSecretProvider secretProvider) {\n    if (secretProvider == null) {\n      throw new IllegalArgumentException(\"secretProvider cannot be NULL\");\n    }\n    this.secretProvider = secretProvider;\n  }\n\n  /**\n   * Returns a signed string.\n   *\n   * @param str string to sign.\n   *\n   * @return the signed string.\n   */\n  public synchronized String sign(String str) {\n    if (str == null || str.length() == 0) {\n      throw new IllegalArgumentException(\"NULL or empty string to sign\");\n    }\n    byte[] secret = secretProvider.getCurrentSecret();\n    String signature = computeSignature(secret, str);\n    return str + SIGNATURE + signature;","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/Signer.java#L24-L60","documentation":"Signer computes and verifies the HMAC-SHA256 signature appended to authentication cookie values, delegating secret management to a SignerSecretProvider. The constructor requires a non-null, already-initialized provider; passing null throws IllegalArgumentException('secretProvider cannot be NULL') to fail fast rather than NPE later during signing.","triggerScenarios":"new Signer(null) — typically because the SignerSecretProvider was constructed/initialized conditionally and the variable stayed null (config branch not taken, initialization swallowed an error).","commonSituations":"Custom authentication filters wiring their own provider chain; refactoring that moves provider init after Signer construction; tests instantiating Signer without setting up a provider.","solutions":["Initialize a concrete SignerSecretProvider (RandomSignerSecretProvider, FileSignerSecretProvider, ZKSignerSecretProvider) first and pass that instance","Check provider initialization for swallowed exceptions so the variable is never silently null","For tests, use a provider with a fixed secret to keep behavior deterministic"],"exampleFix":"// before\nSigner signer = new Signer(null);\n\n// after\nSignerSecretProvider provider = new RandomSignerSecretProvider();\nprovider.init(new Properties(), null, -1);\nSigner signer = new Signer(provider);","handlingStrategy":"type-guard","validationCode":"if (secretProvider == null) throw new IllegalStateException(\"SignerSecretProvider not initialized — check init() for swallowed errors\");","typeGuard":"static boolean isUsableProvider(SignerSecretProvider p) {\n  return p != null && p.getCurrentSecret() != null && p.getCurrentSecret().length > 0;\n}","tryCatchPattern":"not needed once construction is guarded — fix the wiring so the provider is initialized before new Signer(provider)","preventionTips":["Construct and init the provider before the Signer, in the same code path","Never swallow exceptions during provider init","Unit-test the wiring with a fixed-secret provider"],"tags":["hadoop-auth","signing","null-check","constructor"],"backgroundTag":"null-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}