{"record":{"id":"544f382abe1ce7ec","repo":"alibaba/nacos","slug":"password-cannot-be-null","errorCode":null,"errorMessage":"Password cannot be null","messagePattern":"Password cannot be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/PasswordEncoderUtil.java","lineNumber":41,"sourceCode":" * Password encoder tool.\n *\n * @author nacos\n */\npublic class PasswordEncoderUtil {\n    \n    public static Boolean matches(String raw, String encoded) {\n        return new SafeBcryptPasswordEncoder().matches(raw, encoded);\n    }\n    \n    /**\n     * Encode password.\n     *\n     * @param raw password\n     * @return encoded password\n     */\n    public static String encode(String raw) {\n        if (raw == null) {\n            throw new IllegalArgumentException(\"Password cannot be null\");\n        }\n        if (raw.length() > AuthConstants.MAX_PASSWORD_LENGTH) {\n            throw new IllegalArgumentException(\"Password length must not exceed \"\n                + AuthConstants.MAX_PASSWORD_LENGTH + \" characters\");\n        }\n        return new SafeBcryptPasswordEncoder().encode(raw);\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":50,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/PasswordEncoderUtil.java#L23-L50","documentation":"Thrown by PasswordEncoderUtil.encode() when the raw password argument is null. This is a precondition check before passing the password to the SafeBcryptPasswordEncoder. The method does not accept null because BCrypt encoding of null would either NPE internally or produce meaningless output.","triggerScenarios":"Calling PasswordEncoderUtil.encode(null) directly, or passing a password variable that was never initialized / came from a missing form field / was set to null by upstream code.","commonSituations":"A user creation or password update form submitted without a password field; a configuration or migration script that passes null for a password; an API call where the password parameter is omitted and defaults to null in the Java binding.","solutions":["Validate that the password is non-null before calling encode() — check at the controller or form-validation layer.","If the password is optional in your flow, provide a default or reject the request with a clear validation error before reaching encode().","Ensure all code paths that call createUser or updateUserPassword supply a non-null password."],"exampleFix":"// before\nString encoded = PasswordEncoderUtil.encode(password); // NPE if password is null\n\n// after\nif (password == null || password.isBlank()) {\n    throw new IllegalArgumentException(\"Password is required\");\n}\nString encoded = PasswordEncoderUtil.encode(password);","handlingStrategy":"validation","validationCode":"// Validate password is non-null before encoding\nif (raw == null) {\n    throw new IllegalArgumentException(\"Password is required and cannot be null\");\n}\nString encoded = PasswordEncoderUtil.encode(raw);","typeGuard":"public static boolean isEncodablePassword(String raw) {\n    return raw != null;\n}","tryCatchPattern":"try {\n    String encoded = PasswordEncoderUtil.encode(rawPassword);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"cannot be null\")) {\n        // handle missing password at the UI/API layer\n        return Result.failure(\"Password is required\");\n    }\n    throw e;\n}","preventionTips":["Always validate that password is non-null at the controller or form layer.","Use @NotNull or @NotBlank Bean Validation annotations on password fields in request models.","Never pass a potentially-null password variable to encode() without a null check."],"tags":["auth","password","validation","precondition"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}