{"record":{"id":"4a7e331e3d0c1396","repo":"AlistGo/alist","slug":"password-is-empty","errorCode":null,"errorMessage":"password is empty","messagePattern":"password is empty","errorType":"validation","errorClass":"EmptyPassword","httpStatus":null,"severity":"warning","filePath":"internal/errs/user.go","lineNumber":7,"sourceCode":"package errs\n\nimport \"errors\"\n\nvar (\n\tEmptyUsername      = errors.New(\"username is empty\")\n\tEmptyPassword      = errors.New(\"password is empty\")\n\tWrongPassword      = errors.New(\"password is incorrect\")\n\tDeleteAdminOrGuest = errors.New(\"cannot delete admin or guest\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":11,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/internal/errs/user.go#L1-L11","documentation":"EmptyPassword is a sentinel in internal/errs/user.go raised when a request that requires a password supplies an empty one. Login validation rejects it immediately (an empty password can never match the stored hash), and user creation/update requires a non-empty password.","triggerScenarios":"Login request with an empty or missing password field; admin API creating/updating a user without a password; password hash generation attempted on an empty string.","commonSituations":"Login forms submitted before the password field is filled; scripts/CI credentials with an unset environment variable producing an empty password; password managers failing to autofill; JSON key typos like 'pass' instead of 'password'.","solutions":["Supply the actual password in the 'password' field of the request","Verify environment variables holding credentials are set and non-empty in automation","Add a client-side non-empty check before calling login or user APIs","If creating a user, generate and pass an initial password"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client-side guard before login/user APIs\nif strings.TrimSpace(password) == \"\" {\n    return errs.EmptyPassword\n}","typeGuard":"func hasPassword(s string) bool { return strings.TrimSpace(s) != \"\" }","tryCatchPattern":"if err := login(user, pass); err != nil {\n    if errors.Is(err, errs.EmptyPassword) { /* prompt for password */ }\n}","preventionTips":["Check credential env vars are set in automation","Verify autofill actually populated the field","Use the exact JSON key 'password'","Reject empty passwords client-side"],"tags":["auth","user","password","validation"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}