{"record":{"id":"7dafbd3999753197","repo":"quarkusio/quarkus","slug":"audiences-must-not-be-null","errorCode":null,"errorMessage":"Audiences must not be null","messagePattern":"Audiences must not be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":153,"sourceCode":"    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken() {\n        if (defaultAudiences == null) {\n            throw new IllegalStateException(\n                    \"No default audiences configured via 'quarkus.spiffe-client.audiences'; \"\n                            + \"either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience\");\n        }\n        return fetchWorkloadJsonWebTokens(defaultAudiences).toUni();\n    }\n\n    @Override\n    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(String audience) {\n        validateAudience(audience);\n        return fetchWorkloadJsonWebTokens(Set.of(audience)).toUni();\n    }\n\n    @Override\n    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(Set<String> audiences) {\n        if (audiences == null) {\n            throw new IllegalArgumentException(\"Audiences must not be null\");\n        }\n        if (audiences.isEmpty()) {\n            throw new IllegalArgumentException(\"Audiences must not be empty\");\n        }\n        for (String audience : audiences) {\n            validateAudience(audience);\n        }\n        return fetchWorkloadJsonWebTokens(audiences).toUni();\n    }\n\n    @PreDestroy\n    void close() {\n        client.close();\n    }\n\n    private Multi<WorkloadJsonWebToken> fetchWorkloadJsonWebTokens(Set<String> audiences) {\n        JWTSVIDRequest.Builder proto = JWTSVIDRequest.newBuilder();\n        proto.addAllAudience(audiences);","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L135-L171","documentation":"SpiffeClientImpl.getWorkloadJsonWebToken(Set<String> audiences) validates its input before fetching JWT-SVIDs: a null set throws IllegalArgumentException 'Audiences must not be null' (an empty set throws a sibling error). The SPIFFE Workload API requires at least one audience per token request.","triggerScenarios":"Calling getWorkloadJsonWebToken(audiences) with a null Set — e.g. a caller variable that failed to initialize, a null config-derived set, or a method chain that passes null through.","commonSituations":"Building the audience set from optional config and passing the null result; framework-injected values that end up null in tests; refactors changing the overload from single String (which would NPE differently) to Set and forgetting null handling.","solutions":["Pass a non-null, non-empty Set of audiences; validate at the call site before invoking.","Use getWorkloadJsonWebToken(String) for a single known audience instead of constructing a set.","If the set comes from configuration, default it (Set.of(...)) when absent."],"exampleFix":"// before\nSet<String> audiences = config.getOptionalValue(\"my.audiences\", ...).orElse(null);\nspiffeClient.getWorkloadJsonWebToken(audiences); // NPE-safe but IAE\n\n// after\nSet<String> audiences = config.getOptionalValue(\"my.audiences\", String.class)\n        .map(v -> Set.of(v.split(\",\")))\n        .orElse(Set.of(\"https://default.example.com\"));\nspiffeClient.getWorkloadJsonWebToken(audiences);","handlingStrategy":"validation","validationCode":"if (audiences == null || audiences.isEmpty()) {\n    throw new IllegalArgumentException(\"audiences must be a non-null, non-empty set\");\n}\nspiffeClient.getWorkloadJsonWebToken(audiences);","typeGuard":"static boolean isValidAudiences(Set<String> audiences) {\n    return audiences != null && !audiences.isEmpty()\n        && audiences.stream().allMatch(a -> a != null && !a.isBlank());\n}","tryCatchPattern":"try {\n    return spiffeClient.getWorkloadJsonWebToken(audiences);\n} catch (IllegalArgumentException e) {\n    LOG.error(\"Invalid audiences argument: \" + e.getMessage());\n    throw e;\n}","preventionTips":["Default optional config-derived audience sets with Set.of(...) when absent","Use the single-String overload when there is exactly one audience","Null-check config-sourced collections before passing them into the client"],"tags":["quarkus","spiffe","jwt-svid","illegal-argument","audiences"],"backgroundTag":"null-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}