{"record":{"id":"6c4cb9d24b01bf2c","repo":"quarkusio/quarkus","slug":"iteration-count-must-be-greater-than-zero","errorCode":null,"errorMessage":"Iteration count must be greater than zero","messagePattern":"Iteration count must be greater than zero","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/elytron-security-common/runtime/src/main/java/io/quarkus/elytron/security/common/BcryptUtil.java","lineNumber":66,"sourceCode":"        random.nextBytes(salt);\n        return bcryptHash(password, iterationCount, salt);\n    }\n\n    /**\n     * Produces a Modular Crypt Format bcrypt hash of the given password, using the specified salt and the specified iteration\n     * count.\n     *\n     * @param password the password to hash\n     * @param iterationCount the number of iterations to use while hashing\n     * @param salt the salt to use while hashing\n     * @return the Modular Crypt Format bcrypt hash of the given password\n     * @throws NullPointerException if the password or salt are null\n     * @throws IllegalArgumentException if the iterationCount parameter is negative or zero, or if the salt length is not equal\n     *         to 16\n     */\n    public static String bcryptHash(String password, int iterationCount, byte[] salt) {\n        if (iterationCount <= 0) {\n            throw new IllegalArgumentException(\"Iteration count must be greater than zero\");\n        }\n        Objects.requireNonNull(password, \"password is required\");\n        Objects.requireNonNull(salt, \"salt is required\");\n        if (salt.length != BCryptPassword.BCRYPT_SALT_SIZE) {\n            throw new IllegalArgumentException(\"Salt length must be exactly \" + BCryptPassword.BCRYPT_SALT_SIZE + \" bytes\");\n        }\n\n        PasswordFactory passwordFactory;\n        try {\n            passwordFactory = PasswordFactory.getInstance(BCryptPassword.ALGORITHM_BCRYPT, provider);\n        } catch (NoSuchAlgorithmException e) {\n            // can't really happen\n            throw new RuntimeException(e);\n        }\n\n        IteratedSaltedPasswordAlgorithmSpec iteratedAlgorithmSpec = new IteratedSaltedPasswordAlgorithmSpec(iterationCount,\n                salt);\n        EncryptablePasswordSpec encryptableSpec = new EncryptablePasswordSpec(password.toCharArray(), iteratedAlgorithmSpec);","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/elytron-security-common/runtime/src/main/java/io/quarkus/elytron/security/common/BcryptUtil.java#L48-L84","documentation":"BcryptUtil.bcryptHash(password, iterationCount, salt) validates arguments before delegating to Elytron's BCrypt PasswordFactory. It throws IllegalArgumentException when iterationCount is zero or negative, because bcrypt requires a positive work factor (Elytron uses it as the log-rounds parameter).","triggerScenarios":"Calling bcryptHash with an iteration count <= 0 — typically a variable holding a config value of 0/default, a failed Integer.parseInt yielding bad data, or code passing a sentinel -1 for 'default'.","commonSituations":"quarkus.security.users.embedded.bcrypt iteration count property set to 0 or left unset and read as 0; programmatic hashing in tests with an uninitialized counter; copying the 3-arg overload and passing salt iteration count by mistake.","solutions":["Pass a positive iteration count; the Elytron default is 10 (use BcryptUtil.bcryptHash(password) for the default).","If reading iteration count from config, guard with a fallback default when <= 0.","Ensure no variable-shadowing bug passes the salt length or another int into the iterationCount parameter."],"exampleFix":"// before\nint rounds = config.bcryptRounds(); // 0 when unset\nString hash = BcryptUtil.bcryptHash(pwd, rounds, salt);\n// after\nint rounds = Math.max(config.bcryptRounds(), 10);\nString hash = BcryptUtil.bcryptHash(pwd, rounds, salt);","handlingStrategy":"validation","validationCode":"// validate iteration count before calling bcryptHash\nif (iterationCount <= 0) {\n    iterationCount = 10; // Elytron default\n}\nString hash = BcryptUtil.bcryptHash(password, iterationCount, salt);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the 1-arg BcryptUtil.bcryptHash(password) unless you need custom rounds.","Clamp config-driven iteration counts with a sane default (>= 10).","Unit-test hashing helpers with boundary values (0, -1, large).","Never pass sentinel values like -1 for 'default'."],"tags":["security","bcrypt","password-hashing","illegal-argument"],"backgroundTag":"invalid-argument-value","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}