{"record":{"id":"3e427f82a5fb47e0","repo":"quarkusio/quarkus","slug":"source-role-must-not-be-null","errorCode":null,"errorMessage":"Source role must not be null","messagePattern":"Source role must not be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":260,"sourceCode":"            @Override\n            public void accept(String sourceRole, List<String> targetRoles) {\n                if (sourceRole.isEmpty()) {\n                    throw new IllegalArgumentException(\"Source role must not be empty\");\n                }\n                if (targetRoles == null || targetRoles.isEmpty()) {\n                    throw new IllegalArgumentException(\"Target roles for role '%s' must not be empty\".formatted(sourceRole));\n                }\n            }\n        });\n\n        this.rolesMapping = RolesMapping.of(roleToRoles);\n        return this;\n    }\n\n    @Override\n    public HttpSecurity rolesMapping(String sourceRole, List<String> targetRoles) {\n        if (sourceRole == null) {\n            throw new IllegalArgumentException(\"Source role must not be null\");\n        }\n        if (targetRoles == null) {\n            throw new IllegalArgumentException(\"Target roles for role '%s' must not be null\".formatted(sourceRole));\n        }\n        return rolesMapping(Map.of(sourceRole, targetRoles));\n    }\n\n    @Override\n    public HttpSecurity rolesMapping(String sourceRole, String targetRole) {\n        if (targetRole == null) {\n            throw new IllegalArgumentException(\"Target role for role '%s' must not be null\".formatted(sourceRole));\n        }\n        return rolesMapping(sourceRole, List.of(targetRole));\n    }\n\n    void addHttpPermissions(List<HttpPermissionCarrier> httpPermissions) {\n        this.httpPermissions.addAll(httpPermissions);\n    }","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L242-L278","documentation":"The single-entry overload HttpSecurity.rolesMapping(String sourceRole, List<String> targetRoles) rejects a null source role with IllegalArgumentException before any mapping is built. The source role is the key of the mapping, so it must be a concrete non-null role name. After the null checks the method delegates to the Map-based rolesMapping, which applies the additional empty-value checks.","triggerScenarios":"rolesMapping(null, List.of(\"admin\")); passing a role variable that failed to resolve (e.g. a method returning the configured source role that was null in the current deployment); chaining from a config reader that yields null for a missing key.","commonSituations":"Programmatic security setup (HttpSecurity DSL in a recorder/observer) where the role name comes from optional configuration; refactoring that reordered initialization so a role-name field was still null; test code constructing mappings with placeholder nulls.","solutions":["Pass a non-null source role string; verify the variable is initialized before the call.","If the role name comes from configuration, treat a missing value as 'skip this mapping' instead of calling rolesMapping.","Use Objects.requireNonNull(sourceRole) at the call site with your own descriptive message to catch the problem earlier."],"exampleFix":"// before\nString source = config.sourceRole(); // may be null\nhttpSecurity.rolesMapping(source, List.of(\"admin\"));\n// after\nif (config.sourceRole() != null) {\n    httpSecurity.rolesMapping(config.sourceRole(), List.of(\"admin\"));\n}","handlingStrategy":"validation","validationCode":"if (sourceRole != null) {\n    httpSecurity.rolesMapping(sourceRole, targetRoles);\n}","typeGuard":"static boolean hasSourceRole(String sourceRole) {\n    return sourceRole != null && !sourceRole.isBlank();\n}","tryCatchPattern":"try {\n    httpSecurity.rolesMapping(source, targets);\n} catch (IllegalArgumentException e) {\n    throw new IllegalStateException(\"rolesMapping requires a source role: \" + e.getMessage(), e);\n}","preventionTips":["Resolve role names from config with explicit defaults so they are never null.","Check optional config values for null before forwarding them into the DSL.","Keep literal role names in constants to avoid accidental nulls in refactors."],"tags":["quarkus","http-security","role-mapping","null-check","argument-validation"],"backgroundTag":"null-argument-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}