{"record":{"id":"5e96e39fbb9adac8","repo":"apache/cassandra","slug":"invalid-value-for-property-s-it-must-be-a-stri","errorCode":null,"errorMessage":"Invalid value for property '%s'. It must be a string","messagePattern":"Invalid value for property '(.+?)'\\. It must be a string","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/RoleOptions.java","lineNumber":154,"sourceCode":"    {\n        for (Map.Entry<IRoleManager.Option, Object> option : options.entrySet())\n        {\n            if (!DatabaseDescriptor.getRoleManager().supportedOptions().contains(option.getKey()))\n                throw new InvalidRequestException(String.format(\"%s doesn't support %s\",\n                                                                DatabaseDescriptor.getRoleManager().getClass().getName(),\n                                                                option.getKey()));\n            switch (option.getKey())\n            {\n                case LOGIN:\n                case SUPERUSER:\n                    if (!(option.getValue() instanceof Boolean))\n                        throw new InvalidRequestException(String.format(\"Invalid value for property '%s'. \" +\n                                                                        \"It must be a boolean\",\n                                                                        option.getKey()));\n                    break;\n                case PASSWORD:\n                    if (!(option.getValue() instanceof String))\n                        throw new InvalidRequestException(String.format(\"Invalid value for property '%s'. \" +\n                                                                        \"It must be a string\",\n                                                                        option.getKey()));\n                    if (options.containsKey(IRoleManager.Option.HASHED_PASSWORD))\n                        throw new InvalidRequestException(String.format(\"Properties '%s' and '%s' are mutually exclusive\",\n                                                                        IRoleManager.Option.PASSWORD, IRoleManager.Option.HASHED_PASSWORD));\n                    break;\n                case HASHED_PASSWORD:\n                    if (!(option.getValue() instanceof String))\n                        throw new InvalidRequestException(String.format(\"Invalid value for property '%s'. \" +\n                                                                        \"It must be a string\",\n                                                                        option.getKey()));\n                    if (options.containsKey(IRoleManager.Option.PASSWORD))\n                        throw new InvalidRequestException(String.format(\"Properties '%s' and '%s' are mutually exclusive\",\n                                                                        IRoleManager.Option.PASSWORD, IRoleManager.Option.HASHED_PASSWORD));\n                    try\n                    {\n                        BCrypt.checkpw(\"dummy\", (String) option.getValue());\n                    }","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/RoleOptions.java#L136-L172","documentation":"RoleOptions.validate() requires the PASSWORD option value to be a String. If the CQL term for PASSWORD parses to another type (e.g. a number or boolean literal), validate() throws InvalidRequestException stating the property must be a string.","triggerScenarios":"CREATE ROLE ... WITH PASSWORD = 12345 — the password given as an unquoted numeric literal, so it is not a String when validate() runs.","commonSituations":"Programmatic statement builders binding non-string values into the PASSWORD option; users writing passwords that look numeric without quotes.","solutions":["Quote the password: WITH PASSWORD = '12345'.","In programmatic construction, put a String value into the options map for IRoleManager.Option.PASSWORD.","Escape special characters in passwords per CQL string literal rules."],"exampleFix":"// before\nCREATE ROLE alice WITH PASSWORD = 12345;\n// after\nCREATE ROLE alice WITH PASSWORD = '12345';","handlingStrategy":"type-guard","validationCode":"Object v = roleOptions.get(IRoleManager.Option.PASSWORD);\nif (v != null && !(v instanceof String))\n    throw new IllegalArgumentException(\"PASSWORD must be a quoted CQL string\");","typeGuard":"boolean isStringOption(Object v) { return v instanceof String; }","tryCatchPattern":"try {\n    session.execute(\"CREATE ROLE alice WITH PASSWORD = ?\", password); // driver sends String\n} catch (InvalidRequestException e) {\n    if (e.getMessage().contains(\"It must be a string\")) {\n        // retry with quoted string value\n    }\n}","preventionTips":["Always quote passwords in CQL statements.","Use bound parameters so types are explicit.","Reject non-string passwords in provisioning code."],"tags":["cassandra","auth","roles","type-error"],"backgroundTag":"invalid-argument-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}