{"record":{"id":"71cfcc6899acdc10","repo":"apple/pkl","slug":"no-security-manager-set","errorCode":null,"errorMessage":"No security manager set.","messagePattern":"No security manager set\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/SecurityManagers.java","lineNumber":342,"sourceCode":"    public List<Pattern> getAllowedResources() {\n      return allowedResources;\n    }\n\n    @Override\n    public StandardBuilder setRootDir(@Nullable Path rootDir) {\n      this.rootDir = rootDir;\n      return this;\n    }\n\n    @Override\n    public @Nullable Path getRootDir() {\n      return rootDir;\n    }\n\n    @Override\n    public SecurityManager build() {\n      if (allowedResources.isEmpty() && allowedModules.isEmpty()) {\n        throw new IllegalStateException(\"No security manager set.\");\n      }\n\n      return new Standard(allowedModules, allowedResources, defaultTrustLevels, rootDir);\n    }\n  }\n}\n","sourceCodeStart":324,"sourceCodeEnd":349,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/SecurityManagers.java#L324-L349","documentation":"SecurityManagers.StandardBuilder.build() refuses to construct a Standard security manager when both allowedModules and allowedResources are empty, because such a manager would deny every access. It throws IllegalStateException with message \"No security manager set.\"","triggerScenarios":"Calling build() on a SecurityManagers.StandardBuilder instance where neither allowModule(...) nor allowResource(...) (or equivalent list mutations) was invoked.","commonSituations":"Programmatically building a SecurityManager from config where the allow-list keys were absent/misspelled; conditional code paths that skip allow-list population; copy-pasting builder setup and deleting the allowModule calls.","solutions":["Call allowModule()/allowResource() at least once before build(), or populate allowedModules/allowedResources lists.","If no restriction is desired, use SecurityManagers.softAllowAll() / omit installing a security manager instead of building an empty Standard one.","Log/validate builder state before build() to fail earlier with a clearer message."],"exampleFix":"// before\nSecurityManager sm = new SecurityManagers.StandardBuilder().build(); // throws\n// after\nSecurityManager sm = new SecurityManagers.StandardBuilder()\n    .allowModules(List.of(\"pkl:base\"))\n    .allowResources(List.of(\"file://cfg/**\"))\n    .build();","handlingStrategy":"validation","validationCode":"if (allowedModules.isEmpty() && allowedResources.isEmpty()) {\n  throw new IllegalStateException(\"Configure at least one allowed module or resource before build()\");\n}\nSecurityManager sm = builder.build();","typeGuard":null,"tryCatchPattern":"try {\n  sm = builder.build();\n} catch (IllegalStateException e) {\n  if (e.getMessage().equals(\"No security manager set.\")) {\n    sm = builder.allowModule(\"pkl:base\").build();\n  } else throw e;\n}","preventionTips":["Centralize SecurityManager construction in one factory that always seeds a baseline allow list.","Fail fast on config load: validate that module/resource allow-list keys exist before building.","Write a unit test asserting build() succeeds for every supported config shape."],"tags":["security","configuration","builder","pkl"],"backgroundTag":"missing-required-config","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}