{"record":{"id":"b890192049c60a51","repo":"java-native-access/jna","slug":"security-descriptor-relative-does-not-contain-owner","errorCode":null,"errorMessage":"SECURITY_DESCRIPTOR_RELATIVE does not contain owner","messagePattern":"SECURITY_DESCRIPTOR_RELATIVE does not contain owner","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java","lineNumber":2875,"sourceCode":"                                                      int objectType,\n                                                      SECURITY_DESCRIPTOR_RELATIVE securityDescriptor,\n                                                      boolean setOwner,\n                                                      boolean setGroup,\n                                                      boolean setDACL,\n                                                      boolean setSACL,\n                                                      boolean setDACLProtectedStatus,\n                                                      boolean setSACLProtectedStatus) {\n\n        final PSID psidOwner = securityDescriptor.getOwner();\n        final PSID psidGroup = securityDescriptor.getGroup();\n        final ACL dacl = securityDescriptor.getDiscretionaryACL();\n        final ACL sacl = securityDescriptor.getSystemACL();\n\n        int infoType = 0;\n        // Parameter validation and infoType flag setting.\n        if (setOwner) {\n            if (psidOwner == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain owner\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidOwner))\n                throw new IllegalArgumentException(\"Owner PSID is invalid\");\n            infoType |= OWNER_SECURITY_INFORMATION;\n        }\n\n        if (setGroup) {\n            if (psidGroup == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain group\");\n            if (!Advapi32.INSTANCE.IsValidSid(psidGroup))\n                throw new IllegalArgumentException(\"Group PSID is invalid\");\n            infoType |= GROUP_SECURITY_INFORMATION;\n        }\n\n        if (setDACL) {\n            if (dacl == null)\n                throw new IllegalArgumentException(\"SECURITY_DESCRIPTOR_RELATIVE does not contain DACL\");\n            if (!Advapi32.INSTANCE.IsValidAcl(dacl.getPointer()))\n                throw new IllegalArgumentException(\"DACL is invalid\");","sourceCodeStart":2857,"sourceCodeEnd":2893,"githubUrl":"https://github.com/java-native-access/jna/blob/d036ad9781adad4b66693e8fa7098e4ac665e0a3/contrib/platform/src/com/sun/jna/platform/win32/Advapi32Util.java#L2857-L2893","documentation":"Advapi32Util.setSecurityDescriptorComponents (SECURITY_DESCRIPTOR_RELATIVE path) validates the fields requested for modification before calling SetSecurityDescriptor components. When setOwner is requested but the SECURITY_DESCRIPTOR_RELATIVE structure has no owner SID (psidOwner is null), the library throws IllegalArgumentException rather than passing a null SID to Win32 Advapi32.","triggerScenarios":"Calling the method with setOwner=true on a SECURITY_DESCRIPTOR_RELATIVE parsed from a security descriptor that lacks an owner SID (e.g. descriptor control bits indicate no owner, or the buffer was truncated/parsed from a partial descriptor).","commonSituations":"Building security descriptors manually with only DACL information but requesting owner modification; parsing descriptors returned by APIs that omit owner data; copying SD components between files/registry keys where one side has no owner.","solutions":["Check psidOwner (or securityDescriptor.getOwner()) for null before requesting owner modification and only set setOwner=true when an owner exists.","Read the owner from the source descriptor via Advapi32Util.getSecurityDescriptorOwner first, or use Advapi32.GetSecurityDescriptorOwner to populate it.","Drop the OWNER_SECURITY_INFORMATION component from the requested info flags so only present components are set.","Construct a complete SECURITY_DESCRIPTOR_RELATIVE including the owner SID before calling the API."],"exampleFix":"// before\nAdvapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n// after\nif (sd.getOwner() != null) {\n    Advapi32Util.setSecurityDescriptorComponents(sd, true, true, true, true, false, false);\n} else {\n    Advapi32Util.setSecurityDescriptorComponents(sd, false, true, true, true, false, false);\n}","handlingStrategy":"validation","validationCode":"if (securityDescriptor.getOwner() == null) {\n    throw new IllegalStateException(\"Descriptor has no owner SID; omit owner component\");\n}","typeGuard":"boolean hasOwner(SECURITY_DESCRIPTOR_RELATIVE sd) {\n    return sd != null && sd.getOwner() != null;\n}","tryCatchPattern":"try {\n    Advapi32Util.setSecurityDescriptorComponents(sd, setOwner, setGroup, setDACL, setSACL, dacalProtected, sacalProtected);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Descriptor component missing/invalid: \" + e.getMessage());\n}","preventionTips":["Always read the owner via Advapi32Util.getSecurityDescriptorOwner before requesting owner updates.","Set each boolean flag (setOwner/setGroup/setDACL/setSACL) only after confirming that component exists.","Avoid building SECURITY_DESCRIPTOR_RELATIVE structures by hand; parse complete descriptors."],"tags":["windows","security-descriptor","null-check","jna"],"backgroundTag":"null-argument","analyzedSha":"d036ad9781adad4b66693e8fa7098e4ac665e0a3","analyzedAt":"2026-09-12T06:50:59.239Z","contentChangedAt":"2026-09-12T06:50:59.239Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}