{"record":{"id":"4b38da9ef0c0a0dc","repo":"google/tsunami-security-scanner","slug":"value-cannot-be-none","errorCode":null,"errorMessage":"Value cannot be None.","messagePattern":"Value cannot be None\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"plugin_server/py/common/net/http/http_headers.py","lineNumber":94,"sourceCode":"    \"\"\"Add HTTP header to headers object.\n\n    Args:\n      name: HTTP header field name\n      value: HTTP header value\n      canonicalize: Optional boolean to normalize header or not. Default is\n        True.\n\n    Returns:\n      The builder object.\n\n    Raises:\n      ValueError: If name or value is None. If header name or value pair does\n      not comply with standards.\n    \"\"\"\n    if name is None:\n      raise ValueError('Name cannot be None.')\n    if value is None:\n      raise ValueError('Value cannot be None.')\n    if canonicalize:\n      name = self._canonicalize_header_name(name, value)\n    self.http_headers.raw_headers[name].append(value)\n    return self\n\n  def _canonicalize_header_name(self, name, value) -> str:\n    if not self._is_legal_header_name(name):\n      raise ValueError('Illegal header name %s.' % name)\n    if not self._is_legal_header_value(value):\n      raise ValueError('Illegal header value %s.' % value)\n    return _canonicalize(name)\n\n  def _is_legal_header_name(self, name: str) -> bool:\n    return bool(re.fullmatch(self.HEADER_NAME_MATCHER, name))\n\n  def _is_legal_header_value(self, value: str) -> bool:\n    return bool(re.fullmatch(self.HEADER_VALUE_MATCHER, value))\n","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/google/tsunami-security-scanner/blob/363ba87b3543f8ae8e4304d3416818f03da7f262/plugin_server/py/common/net/http/http_headers.py#L76-L112","documentation":"HTTPHeaders.add_header validates that both the header name and value are non-None before storing them in raw_headers. This library throws it to prevent None from leaking into the raw headers dict, which would break downstream HTTP request serialization and header canonicalization.","triggerScenarios":"Calling add_header(name=None, value='x') or add_header('X-Foo', None) while building an HttpRequest's headers, typically when the header value comes from a variable that was never assigned or a function that returned None.","commonSituations":"Dynamically built header maps where an optional lookup (e.g. dict.get, env var read, token fetch) returned None; refactored code paths where a default value was removed; passing a config field that is unset.","solutions":["Inspect the call site and find which of name/value is None before calling add_header","Guard the call: only call add_header when both name and value are truthy strings","Provide a default (e.g. value or '') or skip the header entirely if it is genuinely optional","Coerce values loaded from config/env with str() and an explicit None check"],"exampleFix":"// before\nbuilder.add_header('Authorization', get_token())  # get_token() may return None\n// after\ntoken = get_token()\nif token is not None:\n  builder.add_header('Authorization', token)","handlingStrategy":"validation","validationCode":"def safe_add_header(builder, name, value):\n    if name is None or value is None:\n        return False\n    builder.add_header(name, value)\n    return True","typeGuard":"def is_valid_header_pair(name, value) -> bool:\n    return isinstance(name, str) and isinstance(value, str) and bool(name) and bool(value)","tryCatchPattern":"try:\n    builder.add_header(name, value)\nexcept ValueError as e:\n    logging.warning('Skipping invalid header: %s', e)","preventionTips":["Never pass dict.get() results straight into add_header without a None check","Coerce config/env-derived header values with explicit str() and default handling","Add a unit test for every dynamic header path with a missing-value case"],"tags":["python","http","headers","null-check"],"backgroundTag":"null-argument","analyzedSha":"363ba87b3543f8ae8e4304d3416818f03da7f262","analyzedAt":"2026-09-13T01:50:53.990Z","contentChangedAt":"2026-09-13T01:50:53.990Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}