{"record":{"id":"b6a1f44cde2de8ef","repo":"apple/pkl","slug":"cannot-call-both-setsecuritymanager-and-setallo","errorCode":null,"errorMessage":"Cannot call both `setSecurityManager` and `setAllowedModules`, because both define security manager settings.","messagePattern":"Cannot call both `setSecurityManager` and `setAllowedModules`, because both define security manager settings\\.","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java","lineNumber":201,"sourceCode":"\n  public EvaluatorBuilder unsetSecurityManager() {\n    this.securityManager = null;\n    return this;\n  }\n\n  /** Returns the currently set security manager. */\n  public @Nullable SecurityManager getSecurityManager() {\n    return securityManager;\n  }\n\n  /**\n   * Sets the set of URI patterns to be allowed when importing modules.\n   *\n   * @throws IllegalStateException if {@link #setSecurityManager(SecurityManager)} was also called.\n   */\n  public EvaluatorBuilder setAllowedModules(Collection<Pattern> patterns) {\n    if (securityManager != null) {\n      throw new IllegalStateException(\n          \"Cannot call both `setSecurityManager` and `setAllowedModules`, because both define security manager settings.\");\n    }\n    securityManagerBuilder.setAllowedModules(patterns);\n    return this;\n  }\n\n  /** Returns the set of patterns to be allowed when importing modules. */\n  public List<Pattern> getAllowedModules() {\n    return securityManagerBuilder.getAllowedModules();\n  }\n\n  /**\n   * Sets the set of URI patterns to be allowed when reading resources.\n   *\n   * @throws IllegalStateException if {@link #setSecurityManager(SecurityManager)} was also called.\n   */\n  public EvaluatorBuilder setAllowedResources(Collection<Pattern> patterns) {\n    if (securityManager != null) {","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java#L183-L219","documentation":"Guard in EvaluatorBuilder.setAllowedModules: it throws IllegalStateException when a custom SecurityManager was already supplied via setSecurityManager. The two APIs are mutually exclusive ways of defining module-access security; mixing them would make the effective policy ambiguous, so the builder refuses the combination instead of silently merging rules.","triggerScenarios":"Thrown at pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java:201 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Encode the module allow-list inside the custom SecurityManager instead of calling setAllowedModules.","Drop setSecurityManager and rely on setAllowedModules alone for module access control."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}