{"record":{"id":"980a2571deba5e8b","repo":"quarkusio/quarkus","slug":"target-role-for-role-s-must-not-be-null","errorCode":null,"errorMessage":"Target role for role '%s' must not be null","messagePattern":"Target role for role '(.+?)' must not be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":271,"sourceCode":"        this.rolesMapping = RolesMapping.of(roleToRoles);\n        return this;\n    }\n\n    @Override\n    public HttpSecurity rolesMapping(String sourceRole, List<String> targetRoles) {\n        if (sourceRole == null) {\n            throw new IllegalArgumentException(\"Source role must not be null\");\n        }\n        if (targetRoles == null) {\n            throw new IllegalArgumentException(\"Target roles for role '%s' must not be null\".formatted(sourceRole));\n        }\n        return rolesMapping(Map.of(sourceRole, targetRoles));\n    }\n\n    @Override\n    public HttpSecurity rolesMapping(String sourceRole, String targetRole) {\n        if (targetRole == null) {\n            throw new IllegalArgumentException(\"Target role for role '%s' must not be null\".formatted(sourceRole));\n        }\n        return rolesMapping(sourceRole, List.of(targetRole));\n    }\n\n    void addHttpPermissions(List<HttpPermissionCarrier> httpPermissions) {\n        this.httpPermissions.addAll(httpPermissions);\n    }\n\n    private final class AuthorizationPolicy implements Authorization {\n\n        private Policy policy = null;\n\n        @Override\n        public HttpSecurity permit() {\n            validatePolicyNotSetYet();\n            this.policy = new Policy(PermitSecurityPolicy.NAME, null);\n            return HttpSecurityImpl.this;\n        }","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L253-L289","documentation":"The two-string convenience overload rolesMapping(String sourceRole, String targetRole) rejects a null target role with an IllegalArgumentException naming the source role. It exists to let callers map a single source role to a single target role; after the check it delegates to rolesMapping(sourceRole, List.of(targetRole)) and then to the Map-based overload.","triggerScenarios":"rolesMapping(\"user\", null); passing a variable holding the target role that was not initialized or did not resolve from config; copy-pasted call sites where one argument was replaced with a null-returning method call.","commonSituations":"Simple identity-provider-to-application role mappings wired from properties where the target key was misspelled and returned null; refactors that changed a literal (e.g. \"admin\") into a config lookup that can return null.","solutions":["Pass a non-null target role string.","Verify the value source (config key, constant) actually resolves before calling.","Guard with an if-check or Objects.requireNonNull(targetRole) at the call site to fail with clearer context."],"exampleFix":"// before\nhttpSecurity.rolesMapping(\"user\", config.adminRole()); // may be null\n// after\nString adminRole = config.adminRole();\nif (adminRole != null) {\n    httpSecurity.rolesMapping(\"user\", adminRole);\n}","handlingStrategy":"validation","validationCode":"if (targetRole != null) {\n    httpSecurity.rolesMapping(sourceRole, targetRole);\n}","typeGuard":"static boolean canMap(String sourceRole, String targetRole) {\n    return sourceRole != null && targetRole != null\n        && !sourceRole.isBlank() && !targetRole.isBlank();\n}","tryCatchPattern":"try {\n    httpSecurity.rolesMapping(\"user\", adminRole);\n} catch (IllegalArgumentException e) {\n    log.error(\"Invalid role mapping arguments: \" + e.getMessage());\n}","preventionTips":["Resolve the target role name before calling; never inline nullable lookups.","Use Objects.requireNonNull(targetRole, \"target role not configured\") early.","Prefer the List overload when values may be dynamic, and validate the list there."],"tags":["quarkus","http-security","role-mapping","null-check","argument-validation"],"backgroundTag":"null-argument-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}