{"record":{"id":"b339f7a1ea1348b4","repo":"alibaba/spring-ai-alibaba","slug":"invalid-iterations-parameter","errorCode":null,"errorMessage":"Invalid iterations parameter","messagePattern":"Invalid iterations parameter","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/security/PasswordCryptUtils.java","lineNumber":114,"sourceCode":"\n\t\tArgon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);\n\n\t\tif (parts[2].startsWith(\"$v=\")) {\n\t\t\tint version = Integer.parseInt(parts[0].substring(2));\n\t\t\tbuilder.withVersion(version);\n\t\t}\n\n\t\tString[] perfParams = parts[3].split(\",\");\n\t\tif (perfParams.length != 3) {\n\t\t\tthrow new IllegalArgumentException(\"Amount of performance parameters invalid\");\n\t\t}\n\n\t\tif (!perfParams[0].startsWith(\"m=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid memory parameter\");\n\t\t}\n\t\tbuilder.withMemoryAsKB(Integer.parseInt(perfParams[0].substring(2)));\n\t\tif (!perfParams[1].startsWith(\"t=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid iterations parameter\");\n\t\t}\n\t\tbuilder.withIterations(Integer.parseInt(perfParams[1].substring(2)));\n\t\tif (!perfParams[2].startsWith(\"p=\")) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid parallel parameter\");\n\t\t}\n\t\tbuilder.withParallelism(Integer.parseInt(perfParams[2].substring(2)));\n\n\t\tbuilder.withSalt(b64decoder.decode(parts[4]));\n\n\t\tbyte[] decoded = b64decoder.decode(parts[5]);\n\t\tbyte[] hashBytes = new byte[decoded.length];\n\n\t\tArgon2BytesGenerator generator = new Argon2BytesGenerator();\n\t\tgenerator.init(builder.build());\n\t\tgenerator.generateBytes(password.toCharArray(), hashBytes);\n\n\t\tint result = 0;\n\t\tfor (int i = 0; i < decoded.length; i++) {","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/alibaba/spring-ai-alibaba/blob/f82da0b50f35744c13968191be2b1cd2452ef550/spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/security/PasswordCryptUtils.java#L96-L132","documentation":"In PasswordCryptUtils.match(), the second performance parameter of the stored Argon2 hash (parts[3]) must start with 't=' to supply the iteration count. When perfParams[1] lacks the 't=' prefix, match() throws this IllegalArgumentException.","triggerScenarios":"Calling match(rawPassword, storedHash) where the hash's parameter segment has a second item not prefixed with 't=' (e.g. 'm=65536,it=2,p=1' or items in the wrong order).","commonSituations":"Hashes generated by tools with different parameter naming, manual edits to stored hashes, or truncated/corrupted hash rows after a DB migration.","solutions":["Inspect parts[3] of the stored hash and correct the second parameter to the form 't=<iterations>'","Regenerate the hash with PasswordCryptUtils.encode() so it matches the expected PHC layout","If hashes are from a legacy system, write a one-time migration to normalize the parameter segment"],"exampleFix":"// before\nm=65536,iter=2,p=1\n// after\nm=65536,t=2,p=1","handlingStrategy":"validation","validationCode":"String perfSeg = storedHash.split(\"\\\\$\")[3];\nboolean hasT = perfSeg.split(\",\")[1].startsWith(\"t=\");\nif (!hasT) throw new IllegalStateException(\"Hash missing t= iterations param: \" + perfSeg);","typeGuard":"static boolean hasIterationsParam(String hash) {\n    String[] parts = hash.split(\"\\\\$\");\n    return parts.length >= 4 && parts[3].split(\",\").length >= 2 && parts[3].split(\",\")[1].startsWith(\"t=\");\n}","tryCatchPattern":"try {\n    cryptUtils.match(rawPassword, storedHash);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Hash iterations param invalid: {}\", e.getMessage());\n    return false; // treat as failed auth, force re-hash on next login\n}","preventionTips":["Never hand-edit stored hashes; regenerate instead","Validate hash format at write time with a unit test against encode() output","Normalize legacy hashes in a migration script"],"tags":["security","password-hashing","argon2","parsing"],"backgroundTag":"invalid-argument-format","analyzedSha":"f82da0b50f35744c13968191be2b1cd2452ef550","analyzedAt":"2026-09-09T15:32:42.421Z","contentChangedAt":"2026-09-09T15:32:42.421Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}