{"record":{"id":"575007e4f41938ac","repo":"quarkusio/quarkus","slug":"paths-must-not-be-empty","errorCode":null,"errorMessage":"Paths must not be empty","messagePattern":"Paths must not be empty","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":206,"sourceCode":"        return mechanism(mTLSAuthenticationMechanism);\n    }\n\n    @Override\n    public HttpSecurity mTLS(ClientAuth tlsClientAuth) {\n        if (tlsClientAuth == null) {\n            throw new IllegalArgumentException(\"Client authentication cannot be null\");\n        }\n        return switch (tlsClientAuth) {\n            case REQUIRED -> mechanism(MTLS.required());\n            case REQUEST -> mechanism(MTLS.request());\n            case NONE -> throw new IllegalArgumentException(\"Client authentication cannot be disabled with this API\");\n        };\n    }\n\n    @Override\n    public HttpPermission path(String... patterns) {\n        if (patterns == null || patterns.length == 0) {\n            throw new IllegalArgumentException(\"Paths must not be empty\");\n        }\n        var httpPermission = new HttpPermissionImpl(patterns);\n        httpPermissions.add(httpPermission);\n        return httpPermission;\n    }\n\n    @Override\n    public HttpPermission get(String... paths) {\n        return path(paths).methods(\"GET\");\n    }\n\n    @Override\n    public HttpPermission put(String... paths) {\n        return path(paths).methods(\"PUT\");\n    }\n\n    @Override\n    public HttpPermission post(String... paths) {","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L188-L224","documentation":"HttpSecurity.path(String...) creates a new HttpPermission for the given path patterns and starts a permission rule. Calling it with null or an empty array would create a meaningless permission, so Quarkus rejects it with an IllegalArgumentException. All convenience methods (get/put/post/delete) delegate to path(), so they fail the same way.","triggerScenarios":"Calling httpSecurity.path() or path(new String[0]); calling httpSecurity.get(paths) where paths is null/empty (e.g. a List.toArray() on an empty or null-origin list).","commonSituations":"Building path arrays dynamically from config or database where the collection is empty; refactoring that removed a default path constant; calling get(null) by mistake.","solutions":["Pass at least one non-empty path pattern, e.g. httpSecurity.path(\"/api/*\").","Guard dynamic inputs: only call path()/get()/post() when the array has at least one element.","Fix the upstream collection that produced an empty pattern list."],"exampleFix":"// before\nString[] paths = loadPaths(); // may be empty\nhttpSecurity.get(paths); // throws\n// after\nString[] paths = loadPaths();\nif (paths != null && paths.length > 0) {\n    httpSecurity.get(paths);\n}","handlingStrategy":"validation","validationCode":"if (paths == null || paths.length == 0) {\n    throw new IllegalStateException(\"At least one path pattern is required for an HttpPermission\");\n}\nhttpSecurity.path(paths);","typeGuard":"boolean hasPaths(String[] patterns) {\n    return patterns != null && patterns.length > 0;\n}","tryCatchPattern":"try {\n    httpSecurity.get(paths);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Paths must not be empty\")) {\n        log.error(\"No paths supplied for permission rule; check path source (config/db)\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Never call path()/get()/post()/put()/delete() with an empty or null array.","Validate dynamic path collections before building permissions.","Provide a fallback default path (e.g. \"/api/*\") when the source collection is empty, if appropriate."],"tags":["quarkus","http-security","http-permissions","empty-argument"],"backgroundTag":"empty-collection-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}