{"record":{"id":"40fa4430fc59b8a1","repo":"quarkusio/quarkus","slug":"cors-must-not-be-null","errorCode":null,"errorMessage":"CORS must not be null","messagePattern":"CORS must not be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":79,"sourceCode":"        this.corsConfig = vertxHttpConfig == null ? null : vertxHttpConfig.cors();\n        this.csrf = null;\n    }\n\n    @Override\n    public HttpSecurity cors(String origin) {\n        Objects.requireNonNull(origin);\n        return cors(Set.of(origin));\n    }\n\n    @Override\n    public HttpSecurity cors(Set<String> origins) {\n        return cors(CORS.origins(origins).build());\n    }\n\n    @Override\n    public HttpSecurity cors(CORS cors) {\n        if (cors == null) {\n            throw new IllegalArgumentException(\"CORS must not be null\");\n        }\n        final boolean alreadyConfiguredInAppProps = corsConfig.accessControlAllowCredentials().isPresent()\n                || corsConfig.accessControlMaxAge().isPresent()\n                || corsConfig.headers().isPresent()\n                || corsConfig.methods().isPresent()\n                || corsConfig.exposedHeaders().isPresent();\n        if (alreadyConfiguredInAppProps) {\n            throw new IllegalStateException(\n                    \"CORS cannot be configured both programmatically and in the 'application.properties' file\");\n        }\n        final CORSConfig newCorsConfig = (CORSConfig) cors;\n        if (!corsConfig.origins().orElse(List.of()).isEmpty()) {\n            // for example SmallRye OpenAPI extension adds a management URL to 'origins'\n            // and we want users know that they are loosing some configuration\n            final List<String> newOrigins = newCorsConfig.origins().orElse(List.of());\n            final String missingOrigins = corsConfig.origins().get().stream()\n                    .filter(origin -> !newOrigins.contains(origin)).collect(Collectors.joining(\",\"));\n            if (!missingOrigins.isEmpty()) {","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L61-L97","documentation":"The programmatic HttpSecurity API rejects a null CORS argument. HttpSecurity.cors(CORS) performs an explicit null check and throws IllegalArgumentException before merging with the properties-based CORS config.","triggerScenarios":"Calling httpSecurity.cors(null) (or cors(CORS.origins(...).build() returning null via custom builder misuse) in programmatic security setup code.","commonSituations":"Programmatic security configuration in a @QuarkusMain / startup hook where the CORS builder is conditionally built and can yield null; refactors that pass an unset/optional CORS value.","solutions":["Always pass a constructed CORS object: HttpSecurity.CORS.origins(...).build().","Guard the call site and skip cors() entirely when no CORS configuration is intended instead of passing null.","Check builder code for paths that can return null and default to an empty CORS config instead."],"exampleFix":"// before\nhttpSecurity.cors(maybeCors); // maybeCors == null -> IllegalArgumentException\n// after\nif (maybeCors != null) {\n    httpSecurity.cors(maybeCors);\n}","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"static boolean isValidCors(HttpSecurity.CORS c) { return c != null; }\n// usage: if (isValidCors(cors)) httpSecurity.cors(cors);","tryCatchPattern":null,"preventionTips":["Build CORS objects via CORS.origins(...).build() only","Skip cors() call when no config intended instead of passing null","Add unit tests covering null-config paths"],"tags":["cors","security","null-check","programmatic-config","quarkus"],"backgroundTag":"null-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}