{"record":{"id":"8c2665c059116e4b","repo":"NationalSecurityAgency/ghidra","slug":"missing-username-for-password-change","errorCode":null,"errorMessage":"Missing username for password change","messagePattern":"Missing username for password change","errorType":"validation","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/PostgresFunctionDatabase.java","lineNumber":613,"sourceCode":"\t\tresponse.success = true;\n\t}\n\n\t/**\n\t * Entry point for the PrewarmRequest command\n\t * @param request the prewarm request\n\t * @param c Postgres DB connection\n\t * @throws SQLException if there is an error issuing the query\n\t */\n\tprivate void fdbPrewarm(PrewarmRequest request, Connection c) throws SQLException {\n\t\tResponsePrewarm response = request.prewarmresponse;\n\t\tresponse.blockCount = preWarm(c, request.mainIndexConfig, request.secondaryIndexConfig,\n\t\t\trequest.vectorTableConfig);\n\t}\n\n\tprivate void fdbPasswordChange(PasswordChange query, Connection c) throws LSHException {\n\t\tResponsePassword response = query.passwordResponse;\n\t\tif (query.username == null) {\n\t\t\tthrow new LSHException(\"Missing username for password change\");\n\t\t}\n\t\tif (query.newPassword == null || query.newPassword.length == 0) {\n\t\t\tthrow new LSHException(\"No password provided\");\n\t\t}\n\t\tresponse.changeSuccessful = true;\t\t// Response parameters assuming success\n\t\tresponse.errorMessage = null;\n\t\ttry {\n\t\t\tchangePassword(c, query.username, query.newPassword);\n\t\t}\n\t\tcatch (SQLException e) {\n\t\t\tresponse.changeSuccessful = false;\n\t\t\tresponse.errorMessage = e.getMessage();\n\t\t}\n\t}\n\n\t@Override\n\tpublic String formatBitAndSQL(String v1, String v2) {\n\t\treturn \"(\" + v1 + \" & \" + v2 + \")\";","sourceCodeStart":595,"sourceCodeEnd":631,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/PostgresFunctionDatabase.java#L595-L631","documentation":"Thrown by PostgresFunctionDatabase.fdbPasswordChange() when the PasswordChange request's username field is null. The password change operation requires a target user; a null username indicates the request was not properly populated before being sent to the server.","triggerScenarios":"Submitting a PasswordChange query via doQuery() where the username field was never set (it defaults to null in the constructor). This happens when the caller constructs a PasswordChange object but only sets newPassword, omitting the username, or when deserializing a malformed request that lacks the username attribute.","commonSituations":"Client code builds a PasswordChange request but forgets to set username. An XML request was received (via restoreXml) that omits the username attribute. The username was set to null intentionally or by a logic error.","solutions":["Always set PasswordChange.username before submitting the query.","Validate the request fields client-side before calling doQuery().","If parsing XML requests, ensure the username attribute is present and non-null."],"exampleFix":"// before\nPasswordChange q = new PasswordChange();\nq.newPassword = newPass.toCharArray();\n// username is null\ndb.doQuery(q, conn); // throws \"Missing username for password change\"\n\n// after\nPasswordChange q = new PasswordChange();\nq.username = targetUser;\nq.newPassword = newPass.toCharArray();\ndb.doQuery(q, conn);","handlingStrategy":"validation","validationCode":"if (query.username == null || query.username.isEmpty()) {\n    throw new IllegalArgumentException(\"username is required for password change\");\n}\ndb.doQuery(query, conn);","typeGuard":"public static boolean isPasswordChangeValid(PasswordChange q) {\n    return q.username != null && !q.username.isEmpty()\n        && q.newPassword != null && q.newPassword.length > 0;\n}","tryCatchPattern":"try {\n    db.doQuery(query, conn);\n} catch (LSHException e) {\n    if (e.getMessage().contains(\"Missing username\")) {\n        // prompt for / set username, then retry\n        throw e;\n    }\n    throw e;\n}","preventionTips":["Always set PasswordChange.username before submitting the query.","Validate request fields client-side before calling doQuery().","When parsing XML requests, ensure the username attribute is present."],"tags":["bsim","ghidra","postgresql","authentication","validation"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}