{"record":{"id":"293a19b97917aed6","repo":"alibaba/spring-ai-alibaba","slug":"amount-of-performance-parameters-invalid","errorCode":null,"errorMessage":"Amount of performance parameters invalid","messagePattern":"Amount of performance parameters invalid","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/security/PasswordCryptUtils.java","lineNumber":106,"sourceCode":"\t * @return true if the password matches, false otherwise\n\t * @throws IllegalArgumentException if the encoded password format is invalid\n\t */\n\tpublic static boolean match(String password, String encodedPassword) {\n\t\tString[] parts = encodedPassword.split(\"\\\\$\");\n\t\tif (parts.length < 4) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid encoded Argon2-hash\");\n\t\t}\n\n\t\tArgon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);\n\n\t\tif (parts[2].startsWith(\"$v=\")) {\n\t\t\tint version = Integer.parseInt(parts[0].substring(2));\n\t\t\tbuilder.withVersion(version);\n\t\t}\n\n\t\tString[] perfParams = parts[3].split(\",\");\n\t\tif (perfParams.length != 3) {\n\t\t\tthrow new IllegalArgumentException(\"Amount of performance parameters invalid\");\n\t\t}\n\n\t\tif (!perfParams[0].startsWith(\"m=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid memory parameter\");\n\t\t}\n\t\tbuilder.withMemoryAsKB(Integer.parseInt(perfParams[0].substring(2)));\n\t\tif (!perfParams[1].startsWith(\"t=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid iterations parameter\");\n\t\t}\n\t\tbuilder.withIterations(Integer.parseInt(perfParams[1].substring(2)));\n\t\tif (!perfParams[2].startsWith(\"p=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid parallel parameter\");\n\t\t}\n\t\tbuilder.withParallelism(Integer.parseInt(perfParams[2].substring(2)));\n\n\t\tbuilder.withSalt(b64decoder.decode(parts[4]));\n\n\t\tbyte[] decoded = b64decoder.decode(parts[5]);","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/alibaba/spring-ai-alibaba/blob/f82da0b50f35744c13968191be2b1cd2452ef550/spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/security/PasswordCryptUtils.java#L88-L124","documentation":"After splitting an Argon2 hash, match parses the performance parameter section (m=...,t=...,p=...). If the section does not contain exactly 3 comma-separated parameters, the encoded hash is malformed and IllegalArgumentException(\"Amount of performance parameters invalid\") is thrown.","triggerScenarios":"Calling PasswordCryptUtils.match with an encoded hash whose 4th '$'-part splits into something other than 3 comma-separated items — e.g. missing t= or p=, extra commas, or a corrupted/truncated m=t=,p= segment.","commonSituations":"Hashes produced by non-JVM Argon2 implementations with different parameter serialization; manual editing of stored hashes; truncation by fixed-width DB columns cutting the tail parameters.","solutions":["Inspect the stored hash's parameter segment; it must look like m=65536,t=2,p=1","Re-hash affected passwords with PasswordCryptUtils and update the rows","Pre-validate the perf segment (split(',')==3 and each startsWith m=/t=/p=) before calling match","Ensure DB columns are wide enough and no trimming/normalization mangles stored hashes"],"exampleFix":"// before\nboolean ok = PasswordCryptUtils.match(raw, stored); // throws if perf params malformed\n// after\nString[] parts = stored.split(\"\\\\$\");\nboolean ok = parts.length > 3 && parts[3].split(\",\").length == 3\n        && PasswordCryptUtils.match(raw, stored);","handlingStrategy":"validation","validationCode":"boolean hasValidPerfParams(String stored) {\n    String[] parts = stored == null ? new String[0] : stored.split(\"\\\\$\");\n    if (parts.length < 4) return false;\n    String[] perf = parts[3].split(\",\");\n    return perf.length == 3 && perf[0].startsWith(\"m=\") && perf[1].startsWith(\"t=\") && perf[2].startsWith(\"p=\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    boolean ok = PasswordCryptUtils.match(raw, stored);\n} catch (IllegalArgumentException e) {\n    ok = false; // corrupt hash: deny login, schedule re-hash\n}","preventionTips":["Validate the m=,t=,p= segment before storing or verifying hashes","Use generous column sizes so hash tails are never truncated","Re-hash passwords from non-JVM generators whose parameter format differs"],"tags":["security","argon2","password-hashing"],"backgroundTag":"invalid-argument-format","analyzedSha":"f82da0b50f35744c13968191be2b1cd2452ef550","analyzedAt":"2026-09-09T15:32:42.421Z","contentChangedAt":"2026-09-09T15:32:42.421Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}