{"record":{"id":"56aab0d8b6e734eb","repo":"NationalSecurityAgency/ghidra","slug":"no-password-provided","errorCode":null,"errorMessage":"No password provided","messagePattern":"No password provided","errorType":"validation","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/PostgresFunctionDatabase.java","lineNumber":616,"sourceCode":"\t/**\n\t * Entry point for the PrewarmRequest command\n\t * @param request the prewarm request\n\t * @param c Postgres DB connection\n\t * @throws SQLException if there is an error issuing the query\n\t */\n\tprivate void fdbPrewarm(PrewarmRequest request, Connection c) throws SQLException {\n\t\tResponsePrewarm response = request.prewarmresponse;\n\t\tresponse.blockCount = preWarm(c, request.mainIndexConfig, request.secondaryIndexConfig,\n\t\t\trequest.vectorTableConfig);\n\t}\n\n\tprivate void fdbPasswordChange(PasswordChange query, Connection c) throws LSHException {\n\t\tResponsePassword response = query.passwordResponse;\n\t\tif (query.username == null) {\n\t\t\tthrow new LSHException(\"Missing username for password change\");\n\t\t}\n\t\tif (query.newPassword == null || query.newPassword.length == 0) {\n\t\t\tthrow new LSHException(\"No password provided\");\n\t\t}\n\t\tresponse.changeSuccessful = true;\t\t// Response parameters assuming success\n\t\tresponse.errorMessage = null;\n\t\ttry {\n\t\t\tchangePassword(c, query.username, query.newPassword);\n\t\t}\n\t\tcatch (SQLException e) {\n\t\t\tresponse.changeSuccessful = false;\n\t\t\tresponse.errorMessage = e.getMessage();\n\t\t}\n\t}\n\n\t@Override\n\tpublic String formatBitAndSQL(String v1, String v2) {\n\t\treturn \"(\" + v1 + \" & \" + v2 + \")\";\n\t}\n\n}","sourceCodeStart":598,"sourceCodeEnd":634,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/PostgresFunctionDatabase.java#L598-L634","documentation":"Thrown by PostgresFunctionDatabase.fdbPasswordChange() when the PasswordChange request's newPassword field is null or has length zero. A non-empty password is required to perform a password change; a null or empty array indicates the request is incomplete.","triggerScenarios":"Submitting a PasswordChange query where newPassword is null or an empty char[]. This occurs when the caller constructs the request but does not set newPassword, sets it to null, or provides an empty password string. When parsing XML via restoreXml, an empty body element produces an empty char[].","commonSituations":"Client code omits setting newPassword. A UI form submitted an empty password field. The clearPassword() method was called prematurely, zeroing out the array before the request was processed. An XML request body was empty.","solutions":["Always set PasswordChange.newPassword to a non-empty char[] before submitting.","Validate the password is non-empty client-side before calling doQuery().","Ensure clearPassword() is called only after the request has been fully processed, not before submission."],"exampleFix":"// before\nPasswordChange q = new PasswordChange();\nq.username = user;\nq.newPassword = null; // or new char[0]\ndb.doQuery(q, conn); // throws \"No password provided\"\n\n// after\nif (newPass == null || newPass.isEmpty()) {\n    throw new IllegalArgumentException(\"password required\");\n}\nPasswordChange q = new PasswordChange();\nq.username = user;\nq.newPassword = newPass.toCharArray();\ndb.doQuery(q, conn);\nq.clearPassword(); // zero out after use","handlingStrategy":"validation","validationCode":"if (query.newPassword == null || query.newPassword.length == 0) {\n    throw new IllegalArgumentException(\"new password must not be empty\");\n}\ndb.doQuery(query, conn);","typeGuard":"public static boolean isPasswordChangeValid(PasswordChange q) {\n    return q.username != null && !q.username.isEmpty()\n        && q.newPassword != null && q.newPassword.length > 0;\n}","tryCatchPattern":"try {\n    db.doQuery(query, conn);\n} catch (LSHException e) {\n    if (e.getMessage().contains(\"No password provided\")) {\n        // prompt for password, then retry\n        throw e;\n    }\n    throw e;\n}","preventionTips":["Always set PasswordChange.newPassword to a non-empty char[] before submitting.","Call clearPassword() only after the request is fully processed.","Validate password is non-empty client-side before calling doQuery()."],"tags":["bsim","ghidra","postgresql","authentication","validation"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}