{"record":{"id":"3656008725e68850","repo":"flowable/flowable-engine","slug":"start-user-id-is-null","errorCode":null,"errorMessage":"Start user id is null","messagePattern":"Start user id is null","errorType":"validation","errorClass":"FlowableIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/flowable-cmmn-engine/src/main/java/org/flowable/cmmn/engine/impl/runtime/PlanItemInstanceQueryImpl.java","lineNumber":716,"sourceCode":"            this.started = true;\n        }\n        return this;\n    }\n\n    @Override\n    public PlanItemInstanceQuery notStarted() {\n        if (inOrStatement) {\n            this.currentOrQueryObject.notStarted = true;\n        } else {\n            this.notStarted = true;\n        }\n        return this;\n    }\n\n    @Override\n    public PlanItemInstanceQuery planItemInstanceStartUserId(String startUserId) {\n        if (startUserId == null) {\n            throw new FlowableIllegalArgumentException(\"Start user id is null\");\n        }\n        if (inOrStatement) {\n            this.currentOrQueryObject.startUserId = startUserId;\n        } else {\n            this.startUserId = startUserId;\n        }\n        return this;\n    }\n\n    @Override\n    public PlanItemInstanceQuery planItemInstanceAssignee(String assignee) {\n        if (assignee == null) {\n            throw new FlowableIllegalArgumentException(\"assignee is null\");\n        }\n        if (inOrStatement) {\n            this.currentOrQueryObject.assignee = assignee;\n        } else {\n            this.assignee = assignee;","sourceCodeStart":698,"sourceCodeEnd":734,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-cmmn-engine/src/main/java/org/flowable/cmmn/engine/impl/runtime/PlanItemInstanceQueryImpl.java#L698-L734","documentation":"PlanItemInstanceQueryImpl.planItemInstanceStartUserId(String) throws FlowableIllegalArgumentException with message \"Start user id is null\" when the supplied startUserId is null. Flowable treats null criteria values as programmer errors rather than 'no filter', so the caller must either supply a real user id or omit the criterion.","triggerScenarios":"Calling planItemInstanceStartUserId(null), or passing a user id variable sourced from an unauthenticated context, a missing authentication principal, or an unset request parameter.","commonSituations":"Security-context code where the current user id is null because no user is logged in; REST handlers that forward optional query params straight into the Flowable query; tests that forget to set the authenticated user via Authentication.setAuthenticatedUserId.","solutions":["Check the user id for null before building the query and skip the criterion if absent","Ensure the authenticated user is set (e.g. Authentication.setAuthenticatedUserId(userId)) before reading it","Validate the request parameter and return a client error instead of forwarding null","Catch FlowableIllegalArgumentException around query construction for untrusted inputs"],"exampleFix":"// before\nquery.planItemInstanceStartUserId(startUserId); // throws when null\n// after\nif (startUserId != null) {\n    query.planItemInstanceStartUserId(startUserId);\n}","handlingStrategy":"validation","validationCode":"if (startUserId != null && !startUserId.isEmpty()) {\n    query.planItemInstanceStartUserId(startUserId);\n}","typeGuard":"boolean hasStartUser = startUserId != null;","tryCatchPattern":"try {\n    query.planItemInstanceStartUserId(startUserId);\n} catch (FlowableIllegalArgumentException e) {\n    log.warn(\"startUserId was null, filter skipped\");\n}","preventionTips":["Set the authenticated user (Authentication.setAuthenticatedUserId) before querying","Reject requests missing the user filter at the API boundary instead of forwarding null","Conditionally add user-based criteria only when a user is actually known"],"tags":["flowable","cmmn","query","null-argument"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}