{"record":{"id":"2a5b0f898f8f4398","repo":"quarkusio/quarkus","slug":"failed-to-convert-method-argument-s-to-permissi","errorCode":null,"errorMessage":"Failed to convert method argument '%s' to Permission constructor parameter","messagePattern":"Failed to convert method argument '(.+?)' to Permission constructor parameter","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityCheckRecorder.java","lineNumber":434,"sourceCode":"            var handle = MethodHandles.publicLookup().findStatic(clazz.getValue(), methodName,\n                    MethodType.methodType(Object.class, Object.class));\n            return new RuntimeValue<>(handle);\n        } catch (NoSuchMethodException | IllegalAccessException e) {\n            throw new RuntimeException(\"Failed to create Permission constructor method parameter converter\", e);\n        }\n    }\n\n    public RuntimeValue<Class<?>> loadClassRuntimeVal(String className) {\n        return new RuntimeValue<>(loadClass(className));\n    }\n\n    private static Object convertMethodParamToPermParam(int i, Object methodArg,\n            Map<String, RuntimeValue<MethodHandle>> converterNameToMethodHandle, String[] formalParamConverters) {\n        var converter = converterNameToMethodHandle.get(formalParamConverters[i]).getValue();\n        try {\n            return converter.invokeExact(methodArg);\n        } catch (Throwable e) {\n            throw new RuntimeException(\n                    \"Failed to convert method argument '%s' to Permission constructor parameter\".formatted(methodArg), e);\n        }\n    }\n\n    public Function<SyntheticCreationalContext<QuarkusPermissionSecurityIdentityAugmentor>, QuarkusPermissionSecurityIdentityAugmentor> createPermissionAugmentor() {\n        return new Function<SyntheticCreationalContext<QuarkusPermissionSecurityIdentityAugmentor>, QuarkusPermissionSecurityIdentityAugmentor>() {\n            @Override\n            public QuarkusPermissionSecurityIdentityAugmentor apply(\n                    SyntheticCreationalContext<QuarkusPermissionSecurityIdentityAugmentor> ctx) {\n                return new QuarkusPermissionSecurityIdentityAugmentor(ctx.getInjectedReference(BlockingSecurityExecutor.class));\n            }\n        };\n    }\n}\n","sourceCodeStart":416,"sourceCodeEnd":449,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityCheckRecorder.java#L416-L449","documentation":"convertMethodParamToPermParam() invokes the registered parameter converter MethodHandle on a secured method argument when constructing a Permission for @PermissionsAllowed. Any Throwable raised by the converter (ClassCastException, NPE, business-logic failure) is wrapped in a RuntimeException identifying which argument failed conversion.","triggerScenarios":"Invoking a @PermissionsAllowed-annotated method whose argument fails the converter method (e.g. converter does an unchecked cast to a type the actual argument does not match, or the argument is null).","commonSituations":"Runtime argument type differs from the type the converter assumes (e.g. Integer passed where converter casts to String); caller passes null and the converter dereferences it; converter logic throws for specific input values.","solutions":["Read the nested cause (e) in the stack trace to see the converter's actual failure.","Make the converter null-safe and use instanceof checks/casting that tolerate the actual argument types.","Validate or normalize the method argument at the call site before invoking the secured method.","Change the converter to String.valueOf(...) or equivalent rather than a hard cast."],"exampleFix":"// before\npublic static Object convert(Object arg) { return (String) arg; }\n// after\npublic static Object convert(Object arg) { return arg == null ? null : arg.toString(); }","handlingStrategy":"try-catch","validationCode":"// pre-validate arguments before calling the secured method\nif (arg == null || !(arg instanceof String)) {\n    throw new IllegalArgumentException(\"Argument not convertible to permission parameter\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return converter.invokeExact(methodArg);\n} catch (ClassCastException e) {\n    throw new IllegalStateException(\"Converter received unexpected argument type: \" + methodArg.getClass(), e);\n} catch (Throwable e) {\n    throw new IllegalStateException(\"Parameter conversion failed\", e);\n}","preventionTips":["Make converters null-safe (handle null arguments)","Avoid hard casts; use instanceof checks or toString()","Document the expected argument type on the converter method","Test converters with the actual argument types produced by callers"],"tags":["security","permissionsallowed","converter","runtime"],"backgroundTag":"converter-method-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}