{"record":{"id":"96575c47cb1ffb6a","repo":"java-native-access/jna","slug":"security-descriptor-relative-does-not-contain-group","errorCode":null,"errorMessage":"SECURITY_DESCRIPTOR_RELATIVE does not contain group","messagePattern":"SECURITY_DESCRIPTOR_RELATIVE does not contain group","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2883,"sourceCode":"\n        final PSID psidOwner = securityDescriptor.getOwner();\n        final PSID psidGroup = securityDescriptor.getGroup();\n        final ACL dacl = securityDescriptor.getDiscretionaryACL();\n        final ACL sacl = securityDescriptor.getSystemACL();\n\n        int infoType = 0;\n        // Parameter validation and infoType flag setting.\n        if (setOwner) {\n            if (psidOwner == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain owner\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))\n                throw new IllegalArgumentException(\"Owner PSID is invalid\");\n            infoType |= OWNER_SECURITY_INFORMATION;\n        }\n\n        if (setGroup) {\n            if (psidGroup == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");\n            infoType |= DACL_SECURITY_INFORMATION;\n        }\n\n        if (setSACL) {\n            if (sacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain SACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(sacl.getPointer()))\n                throw new IllegalArgumentException(\"SACL is invalid\");","sourceCodeStart":2865,"sourceCodeEnd":2901,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2865-L2901","documentation":"The mirror of error 121 for the group component: when setGroup is requested but the SECURITY_DESCRIPTOR_RELATIVE contains no group SID (psidGroup is null), Advapi32Util throws IllegalArgumentException before issuing the Win32 call.","triggerScenarios":"Calling the method with setGroup=true on a descriptor whose group SID was never set or was not parsed (control bits indicate no group, or the source descriptor omitted it).","commonSituations":"Descriptors created with SE_GROUP_* bits absent; copying only owner/DACL data between objects; parsing a partially populated SECURITY_DESCRIPTOR_RELATIVE from a registry key or file.","solutions":["Check securityDescriptor.getGroup() for null before requesting group modification; set setGroup=false when absent.","Populate the group SID via Advapi32.GetSecurityDescriptorGroup or by re-parsing a complete descriptor.","Remove GROUP_SECURITY_INFORMATION from the requested components so only present parts are applied.","Build the SECURITY_DESCRIPTOR_RELATIVE with all required components before calling the API."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, sd.getGroup() != null, true, true, false, false);","handlingStrategy":"validation","validationCode":"if (securityDescriptor.getGroup() == null) {\n    throw new IllegalStateException(\"Descriptor has no group SID; omit group component\");\n}","typeGuard":"boolean hasGroup(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    return sd != null && sd.getGroup() != null;\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, setOwner, setGroup, setDACL, setSACL, false, false);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Descriptor component missing/invalid: \" + e.getMessage());\n}","preventionTips":["Check getGroup() for null before enabling setGroup.","Read the group via Advapi32.GetSecurityDescriptorGroup when copying between objects.","Only request components actually present in the source descriptor."],"tags":["windows","security-descriptor","null-check","jna"],"backgroundTag":"null-argument","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}