{"record":{"id":"5d34e04f3131ae79","repo":"java-native-access/jna","slug":"security-descriptor-relative-does-not-contain-dacl","errorCode":null,"errorMessage":"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL","messagePattern":"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2891,"sourceCode":"        if (setOwner) {\n            if (psidOwner == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain owner\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))\n                throw new IllegalArgumentException(\"Owner PSID is invalid\");\n            infoType |= OWNER_SECURITY_INFORMATION;\n        }\n\n        if (setGroup) {\n            if (psidGroup == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");\n            infoType |= DACL_SECURITY_INFORMATION;\n        }\n\n        if (setSACL) {\n            if (sacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))\n                throw new IllegalArgumentException(\"SACL is invalid\");\n            infoType |= SACL_SECURITY_INFORMATION;\n        }\n\n        /*\n         * Control bits SE_DACL_PROTECTED/SE_SACL_PROTECTED indicate the *ACL is protected. The *ACL_SECURITY_INFORMATION flags\n         * are meta flags for SetNamedSecurityInfo and are not stored in the SD.  If either *ACLProtectedStatus is set,\n         * get the current status from the securityDescriptor and apply as such, otherwise the ACL remains at its default.\n        */","sourceCodeStart":2873,"sourceCodeEnd":2909,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2873-L2909","documentation":"When setDACL is requested but the SECURITY_DESCRIPTOR_RELATIVE has no DACL (dacl is null), Advapi32Util throws IllegalArgumentException. This prevents applying a null discretionary ACL, which on Windows could otherwise expose the object with no access restrictions.","triggerScenarios":"Calling with setDACL=true on a descriptor whose control bits indicate no DACL present (SE_DACL_PRESENT unset) or whose DACL was not parsed into the ACL structure.","commonSituations":"Descriptors read from objects that only set a SACL; building a descriptor manually with owner/group only; attempting to copy a DACL that was never extracted from the source object.","solutions":["Check securityDescriptor.getDiscretionaryACL() for null and pass setDACL=false when absent.","Extract the DACL first with Advapi32.GetSecurityDescriptorDacl or Advapi32Util.getSecurityDescriptorDacl.","Read the source object's DACL via Advapi32Util.getFileSecurity / getSecurityDescriptorACL before copying.","If setting a null DACL is truly intended, use the lower-level Advapi32.SetSecurityDescriptorDacl with the appropriate flag instead."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, sd.getDiscretionaryACL() != null, true, false, false);","handlingStrategy":"validation","validationCode":"if (securityDescriptor.getDiscretionaryACL() == null) {\n    throw new IllegalStateException(\"Descriptor has no DACL; omit DACL component\");\n}","typeGuard":"boolean hasDACL(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    return sd != null && sd.getDiscretionaryACL() != null;\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, setOwner, setGroup, setDACL, setSACL, false, false);\n} catch (IllegalArgumentException e) {\n    log.warn(\"DACL missing/invalid: \" + e.getMessage());\n}","preventionTips":["Extract the source DACL with Advapi32Util.getSecurityDescriptorDacl before copying.","Never pass a null DACL unintentionally - on Windows a null DACL means 'everyone full control'.","Check the SE_DACL_PRESENT control bit on the source descriptor."],"tags":["windows","security-descriptor","acl","null-check","jna"],"backgroundTag":"null-argument","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}