{"record":{"id":"a62a72dbefebb9d3","repo":"kestra-io/kestra","slug":"generalsecurityexception-e-getmessage-a62a72","errorCode":null,"errorMessage":"GeneralSecurityException: e.getMessage()","messagePattern":"GeneralSecurityException: e\\.getMessage\\(\\)","errorType":"exception","errorClass":"PebbleException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/pebble/functions/EncryptFunction.java","lineNumber":40,"sourceCode":"    public Map<String, String> getArgumentDefaults() {\n        return Map.of(\n            \"key\", SecretFunction.NAME + \"('encryption_key')\",\n            \"plaintext\", \"'value_to_encrypt'\"\n        );\n    }\n\n    @Override\n    public Object execute(Map<String, Object> args, PebbleTemplate self, EvaluationContext context, int lineNumber) {\n        if (!args.containsKey(\"key\") || !args.containsKey(\"plaintext\")) {\n            throw new PebbleException(null, \"The 'encrypt' function expects two arguments 'key' and 'plaintext'.\", lineNumber, self.getName());\n        }\n\n        String key = (String) args.get(\"key\");\n        String plaintext = (String) args.get(\"plaintext\");\n        try {\n            return EncryptionService.encrypt(key, plaintext);\n        } catch (GeneralSecurityException e) {\n            throw new PebbleException(e, e.getMessage(), lineNumber, self.getName());\n        }\n    }\n}\n","sourceCodeStart":22,"sourceCodeEnd":44,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/pebble/functions/EncryptFunction.java#L22-L44","documentation":"Thrown by the Pebble 'encrypt' template function when EncryptionService.encrypt(key, plaintext) raises a GeneralSecurityException. Unlike decrypt(), a clean encrypt rarely fails on data, so this almost always indicates an invalid key: wrong length, non-ASCII/unexpected bytes, or a key that the AES key-derivation/initialization step rejects.","triggerScenarios":"Passing a key whose length is not a valid AES key size; passing a key that contains characters that break key derivation; passing a null resolved by a missing secret; providing a key that is an empty string after secret resolution.","commonSituations":"Using a short or arbitrary password as the AES key instead of a proper 16/24/32-char key; a secret() expression resolving to empty because the secret does not exist or is in another namespace; passing a UUID or sentence as the key.","solutions":["Use a key that is exactly 16, 24, or 32 characters/bytes long to satisfy AES key constraints.","Confirm secret('encryption_key') resolves to a non-empty value by printing it in a throwaway debug task or via a dedicated check.","Generate the key once and store it as a Kestra secret, then reference it consistently via the same secret() expression.","Round-trip encrypt() then decrypt() in a test task to confirm the key is accepted."],"exampleFix":"# before - arbitrary short password fails AES key init\nenc: \"{{ encrypt('pw', value) }}\"\n# after - proper-length key from a secret\nenc: \"{{ encrypt(secret('ENCRYPTION_KEY'), value) }}\"","handlingStrategy":"validation","validationCode":"# Ensure the key resolves to a non-empty string of a valid AES length (16/24/32) before encrypting.\n# {{ (secret('ENCRYPTION_KEY') != null and secret('ENCRYPTION_KEY').length in [16,24,32]) ? encrypt(secret('ENCRYPTION_KEY'), value) : null }}","typeGuard":null,"tryCatchPattern":"# In a wrapper task (Java):\n# try { return EncryptionService.encrypt(key, plaintext); }\n# catch (GeneralSecurityException e) { /* surface key-length/validity error */ }","preventionTips":["Use a 16/24/32-character key generated once and stored as a secret.","Verify secret() resolves to a non-empty value before use.","Avoid arbitrary passwords/UUIDs as AES keys without proper-length handling.","Test the key with a round-trip encrypt/decrypt."],"tags":["pebble","encryption","security","crypto","invalid-key","encrypt"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}