{"record":{"id":"38523ad20ad967f6","repo":"flowable/flowable-engine","slug":"involved-user-is-null","errorCode":null,"errorMessage":"Involved user is null","messagePattern":"Involved user is null","errorType":"validation","errorClass":"FlowableIllegalArgumentException","httpStatus":null,"severity":"error","filePath":"modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessInstanceQueryImpl.java","lineNumber":573,"sourceCode":"            this.subProcessInstanceId = subProcessInstanceId;\n        }\n        return this;\n    }\n\n    @Override\n    public ProcessInstanceQuery excludeSubprocesses(boolean excludeSubprocesses) {\n        if (inOrStatement) {\n            this.currentOrQueryObject.excludeSubprocesses = excludeSubprocesses;\n        } else {\n            this.excludeSubprocesses = excludeSubprocesses;\n        }\n        return this;\n    }\n\n    @Override\n    public ProcessInstanceQuery involvedUser(String involvedUser) {\n        if (involvedUser == null) {\n            throw new FlowableIllegalArgumentException(\"Involved user is null\");\n        }\n\n        if (inOrStatement) {\n            this.currentOrQueryObject.involvedUser = involvedUser;\n        } else {\n            this.involvedUser = involvedUser;\n        }\n        return this;\n    }\n    \n    @Override\n    public ProcessInstanceQuery involvedUser(String userId, String identityLinkType) {\n        if (userId == null) {\n            throw new FlowableIllegalArgumentException(\"userId is null\");\n        }\n        if (identityLinkType == null) {\n            throw new FlowableIllegalArgumentException(\"identityLinkType is null\");\n        }","sourceCodeStart":555,"sourceCodeEnd":591,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessInstanceQueryImpl.java#L555-L591","documentation":"Flowable's ProcessInstanceQuery.involvedUser(String) throws FlowableIllegalArgumentException when the involvedUser argument is null. The involvement filter on process instances requires a concrete user id; a null value cannot be translated into a database condition. The check fails fast during query construction.","triggerScenarios":"Calling processInstanceQuery().involvedUser(null), typically when the user id comes from a request parameter, security context (anonymous/unauthenticated user), or a lookup that returned null.","commonSituations":"Web controllers passing request parameters straight into queries; authenticated-user helpers returning null for anonymous sessions; integration code where the user record was deleted but still referenced.","solutions":["Null-check the user id before building the query and skip the involvedUser filter when absent.","Resolve the current user only when authenticated, and require a non-null user before invoking involvement queries.","Validate at the API boundary (e.g. @NotNull on the request parameter) so null never reaches the Flowable query.","Catch FlowableIllegalArgumentException around query construction and return a 400-style validation error."],"exampleFix":"// before\nString user = securityService.getCurrentUser(); // may be null\nruntimeService.createProcessInstanceQuery().involvedUser(user);\n// after\nString user = securityService.getCurrentUser();\nif (user != null) {\n    runtimeService.createProcessInstanceQuery().involvedUser(user);\n}","handlingStrategy":"validation","validationCode":"if (userId == null || userId.isBlank()) { throw new BadRequestException(\"involvedUser is required\"); }\nruntimeService.createProcessInstanceQuery().involvedUser(userId);","typeGuard":"boolean isPresentUser(String u) { return u != null && !u.isBlank(); }","tryCatchPattern":"try {\n    query.involvedUser(userId);\n} catch (FlowableIllegalArgumentException e) {\n    log.warn(\"involvedUser was null: {}\", e.getMessage());\n    throw new BadRequestException(\"involvedUser must not be null\");\n}","preventionTips":["Never pass security-context or request-parameter user ids into queries without a null/blank check.","Handle anonymous/unauthenticated sessions explicitly before building user-scoped queries.","Use bean validation (@NotNull, @NotBlank) on API inputs feeding Flowable queries.","Verify user existence (identity service lookup) before filtering by involvement."],"tags":["flowable","null-argument","query-api","java"],"backgroundTag":"null-argument","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}