{"record":{"id":"792e44c89c486167","repo":"apache/rocketmq","slug":"the-source-ip-is-empty","errorCode":null,"errorMessage":"The source ip is empty.","messagePattern":"The source ip is empty\\.","errorType":"validation","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java","lineNumber":259,"sourceCode":"            throw new AuthorizationException(\"The resource is null.\");\n        }\n        if (resource.getResourceType() == null) {\n            throw new AuthorizationException(\"The resource type is null.\");\n        }\n        if (resource.getResourcePattern() == null) {\n            throw new AuthorizationException(\"The resource pattern is null.\");\n        }\n        if (CollectionUtils.isEmpty(entry.getActions())) {\n            throw new AuthorizationException(\"The actions is empty.\");\n        }\n        if (entry.getActions().contains(Action.ANY)) {\n            throw new AuthorizationException(\"The actions can not be Any.\");\n        }\n        Environment environment = entry.getEnvironment();\n        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {\n            for (String sourceIp : environment.getSourceIps()) {\n                if (StringUtils.isBlank(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is empty.\");\n                }\n                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is invalid.\");\n                }\n            }\n        }\n        if (entry.getDecision() == null) {\n            throw new AuthorizationException(\"The decision is null or illegal.\");\n        }\n    }\n\n    private <T> CompletableFuture<T> handleException(Exception e) {\n        CompletableFuture<T> result = new CompletableFuture<>();\n        Throwable throwable = ExceptionUtils.getRealException(e);\n        result.completeExceptionally(throwable);\n        return result;\n    }\n","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java#L241-L277","documentation":"Thrown by AuthorizationMetadataManagerImpl.validate() while iterating environment.getSourceIps(): one entry in the policy's source IP whitelist is blank (null, empty, or whitespace-only). When an Environment block is present with a non-empty sourceIps list, every element must be a usable IP or CIDR string.","triggerScenarios":"createAcl/updateAcl with a policy whose environment.sourceIps contains \"\", \"   \", or an empty string produced by a trailing comma in a comma-separated split (e.g. \"192.168.1.1,\").","commonSituations":"Building sourceIps by splitting a config string that ends with a comma; templated ACL JSON that leaves an IP slot empty; copy-paste of a policy with a dangling list element.","solutions":["Remove blank entries from the sourceIps array in the ACL document","If generating from a comma-separated string, filter blanks before setting: Arrays.stream(raw.split(\",\")).map(String::trim).filter(s -> !s.isEmpty()).collect(toList())"],"exampleFix":"// before\nEnvironment env = new Environment();\nenv.setSourceIps(Arrays.asList(\"192.168.1.0/24\", \"\"));\n\n// after\nEnvironment env = new Environment();\nenv.setSourceIps(Arrays.asList(\"192.168.1.0/24\"));","handlingStrategy":"validation","validationCode":"List<String> sanitize(List<String> ips) {\n    return ips == null ? Collections.emptyList()\n        : ips.stream().map(String::trim).filter(s -> !s.isEmpty()).collect(Collectors.toList());\n}\nenv.setSourceIps(sanitize(rawIps));","typeGuard":null,"tryCatchPattern":"try { metadataManager.createAcl(acl).join(); }\ncatch (AuthorizationException e) { /* log, sanitize sourceIps, resubmit */ }","preventionTips":["Always trim and filter list inputs produced by String.split before setting sourceIps","Reject blank entries early in the UI/script that authors ACLs"],"tags":["auth","authorization","acl","ip-filter","validation","rocketmq"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}