{"record":{"id":"366c72bed2ecd1d3","repo":"spring-projects/spring-security","slug":"key-cannot-be-null","errorCode":null,"errorMessage":"key cannot be null","messagePattern":"key cannot be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaRawEncryptor.java","lineNumber":170,"sourceCode":"\t\t\t\tcipher.update(text, pos, limit);\n\t\t\t\tpos += limit;\n\t\t\t\tbyte[] buffer = cipher.doFinal();\n\t\t\t\toutput.write(buffer, 0, buffer.length);\n\t\t\t}\n\t\t\treturn output.toByteArray();\n\t\t}\n\t\tcatch (RuntimeException ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new IllegalStateException(\"Cannot decrypt\", ex);\n\t\t}\n\t}\n\n\t// copied from sun.security.rsa.RSACore.getByteLength(java.math.BigInteger)\n\tpublic static int getByteLength(@Nullable RSAKey key) {\n\t\tif (key == null) {\n\t\t\tthrow new IllegalArgumentException(\"key cannot be null\");\n\t\t}\n\t\tint n = key.getModulus().bitLength();\n\t\treturn (n + 7) >> 3;\n\t}\n\n}\n","sourceCodeStart":152,"sourceCodeEnd":177,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/RsaRawEncryptor.java#L152-L177","documentation":"RsaRawEncryptor.getByteLength(RSAKey) is a static helper (copied from sun.security.rsa.RSACore) that computes the RSA modulus size in bytes. It throws IllegalArgumentException(\"key cannot be null\") when passed a null RSAKey, as a fail-fast guard instead of a NullPointerException.","triggerScenarios":"Calling RsaRawEncryptor.getByteLength(null) directly, or indirectly via maxLength()/encryption helpers when the encryptor was constructed without a key (e.g. key field never initialized).","commonSituations":"Programmatically built RsaRawEncryptor where key injection failed or a nullable key variable was passed; tests calling getByteLength with a mock/unset key.","solutions":["Pass a non-null RSAKey (RSAPublicKey or RSAPrivateKey) to getByteLength.","If using maxLength() on an encryptor, verify the encryptor was constructed with a valid key before calling.","Add a null check on the key at the construction/assignment site."],"exampleFix":"// before\nint max = RsaRawEncryptor.getByteLength(maybeKey);\n// after\nAssert.notNull(maybeKey, \"RSA key must be provided\");\nint max = RsaRawEncryptor.getByteLength(maybeKey);","handlingStrategy":"validation","validationCode":"if (key == null) {\n    throw new IllegalArgumentException(\"RSA key must be initialized before computing byte length\");\n}\nint max = RsaRawEncryptor.getByteLength(key);","typeGuard":"boolean hasKey(@Nullable RSAKey key) { return key != null && key.getModulus() != null; }","tryCatchPattern":"try {\n    int len = RsaRawEncryptor.getByteLength(key);\n} catch (IllegalArgumentException ex) {\n    throw new IllegalStateException(\"Key was not configured\", ex);\n}","preventionTips":["Assert key non-null at encryptor construction time.","Never pass nullable key fields to static helpers without a guard.","Prefer constructing encryptors from a KeyPair generated or loaded in one place."],"tags":["rsa","null-argument","illegal-argument","cryptography"],"backgroundTag":"null-argument","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}