{"record":{"id":"310eb8fea7cd4496","repo":"quarkusio/quarkus","slug":"what-must-not-be-null-310eb8","errorCode":null,"errorMessage":"${what} must not be null","messagePattern":"(.+?) must not be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java","lineNumber":202,"sourceCode":"        public Builder returnExactOrigins(boolean returnExactOrigins) {\n            this.returnExactOrigins = returnExactOrigins;\n            return this;\n        }\n\n        /**\n         * Create a new CORS configuration.\n         *\n         * @return CORS instance, which should be passed to the {@link HttpSecurity} event\n         */\n        public CORS build() {\n            return new CORSImpl(accessControlAllowCredentials, accessControlMaxAge, exposedHeaders, headers, methods, origins,\n                    returnExactOrigins, varyOrigin);\n        }\n\n        private static Optional<List<String>> merge(Optional<List<String>> optionalOriginalList, Set<String> newSet,\n                String what) {\n            if (newSet == null) {\n                throw new IllegalArgumentException(what + \" must not be null\");\n            }\n            if (newSet.isEmpty()) {\n                return optionalOriginalList;\n            }\n            final List<String> result;\n            if (optionalOriginalList.orElse(List.of()).isEmpty()) {\n                result = List.copyOf(newSet);\n            } else {\n                result = Stream.concat(optionalOriginalList.get().stream(), newSet.stream()).toList();\n            }\n            return Optional.of(result);\n        }\n\n        record CORSImpl(Optional<Boolean> accessControlAllowCredentials, Optional<Duration> accessControlMaxAge,\n                Optional<List<String>> exposedHeaders, Optional<List<String>> headers,\n                Optional<List<String>> methods, Optional<List<String>> origins,\n                boolean returnExactOrigins, boolean varyOrigin) implements CORS, CORSConfig {\n            @Override","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java#L184-L220","documentation":"The private CORS.Builder.merge(Optional<List<String>>, Set<String>, String) helper throws IllegalArgumentException(what + \" must not be null\") when the replacement Set passed to exposedHeaders/headers/methods/origins is null. The setters replace the accumulated list, so a null set has no valid meaning.","triggerScenarios":"Calling CORS.builder().exposedHeaders(null), headers(null), methods(null) or origins(null) — usually with a set produced by a nullable collection-returning call.","commonSituations":"Config collections that resolve to null; passing a Map.get result directly; refactoring where a Set field was never initialized.","solutions":["Pass a non-null Set (use Set.of() or Collections.emptySet() if intentionally empty — empty sets are treated as no-op)","Default null collections to an empty set before the call","Fix the collection source to return an empty collection instead of null"],"exampleFix":"// before\nSet<String> origins = configMap.get(\"origins\");\nbuilder.origins(origins);\n// after\nbuilder.origins(configMap.getOrDefault(\"origins\", Set.of()));","handlingStrategy":"validation","validationCode":"builder.origins(set == null ? Set.of() : set);","typeGuard":"static <T> Set<T> orEmpty(Set<T> s) { return s == null ? Set.of() : s; }","tryCatchPattern":null,"preventionTips":["Coerce all collection config to empty-set defaults","Avoid APIs that return null collections","Centralize collection normalization in one helper"],"tags":["quarkus","null-argument","cors","illegal-argument"],"backgroundTag":"null-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}