{"record":{"id":"36df413752125be6","repo":"apache/hadoop","slug":"null-user","errorCode":null,"errorMessage":"Null user","messagePattern":"Null user","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java","lineNumber":1454,"sourceCode":"   */\n  @InterfaceAudience.Public\n  @InterfaceStability.Evolving\n  public static UserGroupInformation createRemoteUser(String user) {\n    return createRemoteUser(user, AuthMethod.SIMPLE);\n  }\n  \n  /**\n   * Create a user from a login name. It is intended to be used for remote\n   * users in RPC, since it won't have any credentials.\n   * @param user the full user principal name, must not be empty or null\n   * @param authMethod authMethod.\n   * @return the UserGroupInformation for the remote user.\n   */\n  @InterfaceAudience.Public\n  @InterfaceStability.Evolving\n  public static UserGroupInformation createRemoteUser(String user, AuthMethod authMethod) {\n    if (user == null || user.isEmpty()) {\n      throw new IllegalArgumentException(\"Null user\");\n    }\n    Subject subject = new Subject();\n    subject.getPrincipals().add(new User(user));\n    UserGroupInformation result = new UserGroupInformation(subject);\n    result.setAuthenticationMethod(authMethod);\n    return result;\n  }\n\n  /**\n   * existing types of authentications' methods\n   */\n  @InterfaceAudience.Public\n  @InterfaceStability.Evolving\n  public enum AuthenticationMethod {\n    // currently we support only one auth per method, but eventually a \n    // subtype is needed to differentiate, ex. if digest is token or ldap\n    SIMPLE(AuthMethod.SIMPLE,\n        HadoopConfiguration.SIMPLE_CONFIG_NAME),","sourceCodeStart":1436,"sourceCodeEnd":1472,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/UserGroupInformation.java#L1436-L1472","documentation":"UGI.createRemoteUser builds an uncredentialed identity for RPC authorization; a null or empty user name is meaningless and rejected with IllegalArgumentException('Null user') before any Subject is built.","triggerScenarios":"createRemoteUser(null) or createRemoteUser(\"\") - usually unvalidated input flowing from an RPC layer, HTTP header/parameter, or deserialized payload.","commonSituations":"Custom auth filters reading a missing proxy-user header; null effective user from a serializer; test harnesses passing empty strings.","solutions":["Validate the remote user name at your trust boundary (non-null, non-empty after trim) before calling createRemoteUser","If the protocol defines an anonymous identity, map missing names to it explicitly","Fail the request early with a 400/403 rather than letting the exception escape mid-RPC"],"exampleFix":"// before\nUserGroupInformation ugi =\n    UserGroupInformation.createRemoteUser(headerUser, AuthMethod.TOKEN);\n// after\nif (headerUser == null || headerUser.trim().isEmpty()) {\n  throw new IllegalArgumentException(\"missing remote user\");\n}\nUserGroupInformation ugi =\n    UserGroupInformation.createRemoteUser(headerUser.trim(), AuthMethod.TOKEN);","handlingStrategy":"validation","validationCode":"if (user == null || user.trim().isEmpty()) {\n  throw new IllegalArgumentException(\"remote user name is required\");\n}\nUserGroupInformation.createRemoteUser(user.trim(), authMethod);","typeGuard":"static boolean isValidRemoteUser(String user) {\n  return user != null && !user.trim().isEmpty();\n}","tryCatchPattern":null,"preventionTips":["Validate identity strings at the trust boundary (HTTP/RPC entry) before they reach UGI","Reject blank proxy/doAs parameters with explicit 4xx responses","Trim input as part of validation"],"tags":["hadoop","ugi","input-validation","rpc"],"backgroundTag":"null-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}