{"record":{"id":"35945d3a05c4d6bb","repo":"flowable/flowable-engine","slug":"candidate-user-is-null-35945d","errorCode":null,"errorMessage":"Candidate user is null","messagePattern":"Candidate user is null","errorType":"validation","errorClass":"ActivitiIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/flowable5-engine/src/main/java/org/activiti/engine/impl/HistoricTaskInstanceQueryImpl.java","lineNumber":1067,"sourceCode":"    @Override\n    public HistoricTaskInstanceQuery withoutDueDate() {\n        return withoutTaskDueDate();\n    }\n\n    @Override\n    public HistoricTaskInstanceQuery taskCategory(String category) {\n        if (inOrStatement) {\n            this.currentOrQueryObject.category = category;\n        } else {\n            this.category = category;\n        }\n        return this;\n    }\n\n    @Override\n    public HistoricTaskInstanceQuery taskCandidateUser(String candidateUser) {\n        if (candidateUser == null) {\n            throw new ActivitiIllegalArgumentException(\"Candidate user is null\");\n        }\n\n        if (inOrStatement) {\n            this.currentOrQueryObject.candidateUser = candidateUser;\n        } else {\n            this.candidateUser = candidateUser;\n        }\n        return this;\n    }\n\n    @Override\n    public HistoricTaskInstanceQuery taskCandidateGroup(String candidateGroup) {\n        if (candidateGroup == null) {\n            throw new ActivitiIllegalArgumentException(\"Candidate group is null\");\n        }\n\n        if (candidateGroups != null) {\n            throw new ActivitiIllegalArgumentException(\"Invalid query usage: cannot set both candidateGroup and candidateGroupIn\");","sourceCodeStart":1049,"sourceCodeEnd":1085,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/HistoricTaskInstanceQueryImpl.java#L1049-L1085","documentation":"HistoricTaskInstanceQueryImpl.taskCandidateUser(String) requires a non-null candidateUser. Since a null candidate would produce an ill-defined candidate filter, the engine throws ActivitiIllegalArgumentException immediately.","triggerScenarios":"Calling taskCandidateUser(null) directly, or passing a variable/parameter that is null (e.g. an unset request parameter or lookup result).","commonSituations":"REST/Service-layer code forwarding an optional 'candidateUser' request param straight into the query; a user-context object that is null for anonymous requests.","solutions":["Check for null and skip the taskCandidateUser(...) call when there is no candidate user to filter on.","Default the value to a concrete user id if a default is meaningful in your domain.","Fail earlier in your own layer with a clear message if a candidate user is required for the operation."],"exampleFix":"// before\nString user = request.getParameter(\"candidateUser\");\nquery.taskCandidateUser(user); // NPE risk -> throws when null\n\n// after\nString user = request.getParameter(\"candidateUser\");\nif (user != null) {\n    query.taskCandidateUser(user);\n}","handlingStrategy":"validation","validationCode":"// Java\nif (candidateUser != null && !candidateUser.isEmpty()) {\n    query.taskCandidateUser(candidateUser);\n}","typeGuard":null,"tryCatchPattern":"try {\n    query.taskCandidateUser(candidateUser);\n} catch (org.activiti.engine.ActivitiIllegalArgumentException e) {\n    // treat as 'no candidate user filter' or reject the request upstream\n}","preventionTips":["Sanitize optional request parameters before passing them into query setters.","Resolve the current user before building candidate-user queries.","Never forward possibly-null variables straight into Flowable/Activiti query setters."],"tags":["query-builder","null-argument","flowable","activiti"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}