{"record":{"id":"7af5d412562d84cf","repo":"apache/cassandra","slug":"null-mbeanserver","errorCode":null,"errorMessage":"Null MBeanServer","messagePattern":"Null MBeanServer","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java","lineNumber":184,"sourceCode":"        Subject subject = Subject.getSubject(acc);\n\n        try\n        {\n            if (\"getMBeanServer\".equals(methodName))\n                throw new SecurityException(\"Access denied\");\n\n            // Corresponds to MBeanServer.invoke\n            if (methodName.equals(\"invoke\") && args.length == 4)\n                checkVulnerableMethods(args);\n\n            // Allow setMBeanServer iff performed on behalf of the connector server itself\n            if ((\"setMBeanServer\").equals(methodName))\n            {\n                if (subject != null)\n                    throw new SecurityException(\"Access denied\");\n\n                if (args[0] == null)\n                    throw new IllegalArgumentException(\"Null MBeanServer\");\n\n                if (mbs != null)\n                    throw new IllegalArgumentException(\"MBeanServer already initialized\");\n\n                mbs = (MBeanServer) args[0];\n                return null;\n            }\n\n            if (authorize(subject, methodName, args))\n            {\n                Object invoke = invoke(method, args);\n                listener.onInvocation(subject, method, args);\n                return invoke;\n            }\n\n            throw new SecurityException(\"Access Denied\");\n        }\n        catch (Exception e)","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java#L166-L202","documentation":"When setMBeanServer passes the no-subject check, the proxy validates its single argument. A null first argument produces IllegalArgumentException(\"Null MBeanServer\") at line 184. The proxy refuses to install a null server because every subsequent operation (authorize, invoke, queryNames) would dereference it and fail with NPEs.","triggerScenarios":"setMBeanServer called (with subject == null, e.g. during connector bootstrap or a test) passing args = new Object[]{null} — i.e. no MBeanServer instance supplied.","commonSituations":"Miswired JMX environment/bootstrap code constructing the connector without a platform MBeanServer; unit tests invoking the proxy's setMBeanServer with an unset local variable; reflection-based setup that silently dropped the server argument.","solutions":["Pass a non-null MBeanServer — typically ManagementFactory.getPlatformMBeanServer() — to setMBeanServer.","Check where the MBeanServer variable comes from; ensure the platform server is obtained before the JMX connector server is constructed.","In tests, assert the server instance is created before invoking the proxy."],"exampleFix":"// before\nproxyMBeanServer.setMBeanServer(null);\n// after\nMBeanServer server = ManagementFactory.getPlatformMBeanServer();\nproxyMBeanServer.setMBeanServer(server);","handlingStrategy":"validation","validationCode":"MBeanServer server = ManagementFactory.getPlatformMBeanServer();\nObjects.requireNonNull(server, \"Platform MBeanServer must exist before JMX connector bootstrap\");\nproxyMBeanServer.setMBeanServer(server);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass ManagementFactory.getPlatformMBeanServer() (or an explicitly constructed server) to setMBeanServer.","Null-check the server argument at the bootstrap call site before wiring the connector."],"tags":["jmx","null-argument","bootstrap"],"backgroundTag":"null-argument","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}