{"record":{"id":"c1456309764ad0ce","repo":"quarkusio/quarkus","slug":"permissions-must-not-be-empty","errorCode":null,"errorMessage":"Permissions must not be empty","messagePattern":"Permissions must not be empty","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":320,"sourceCode":"                throw new IllegalArgumentException(\"Roles must not be empty\");\n            }\n            if (roleToRoles == null) {\n                throw new IllegalArgumentException(\"Role to roles mapping must not be null\");\n            }\n            this.policy = new Policy(null, new RolesAllowedHttpSecurityPolicy(Arrays.asList(roles), null, roleToRoles));\n            return HttpSecurityImpl.this;\n        }\n\n        @Override\n        public HttpSecurity roles(String... roles) {\n            return roles(Map.of(), roles);\n        }\n\n        @Override\n        public HttpSecurity permissions(Permission... permissions) {\n            validatePolicyNotSetYet();\n            if (permissions == null || permissions.length == 0) {\n                throw new IllegalArgumentException(\"Permissions must not be empty\");\n            }\n            policy = new Policy(null, new PermissionsHttpSecurityPolicy(permissions));\n            return HttpSecurityImpl.this;\n        }\n\n        @Override\n        public HttpSecurity permissions(String... permissionNames) {\n            Objects.requireNonNull(permissionNames);\n            StringPermission[] stringPermissions = new StringPermission[permissionNames.length];\n            for (int i = 0; i < permissionNames.length; i++) {\n                stringPermissions[i] = new StringPermission(permissionNames[i]);\n            }\n            return permissions(stringPermissions);\n        }\n\n        @Override\n        public HttpSecurity policy(HttpSecurityPolicy httpSecurityPolicy) {\n            validatePolicyNotSetYet();","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L302-L338","documentation":"The PathPolicy's permissions(Permission...) method rejects a null or zero-length varargs array with IllegalArgumentException. It wraps the given io.quarkus.security.permission.Permission objects in a PermissionsHttpSecurityPolicy for the current path; a permission set with no entries would produce a policy that grants nothing, so the library fails fast instead.","triggerScenarios":"httpSecurity.path(\"/admin/*\").permissions() with no arguments; .permissions(collectedPermissions) where the collection toArray result was empty; .permissions((Permission[]) null).","commonSituations":"Building permission-based security where permissions are loaded from a store/config and none matched the path; conditional permission construction that skipped all permission creation; migrating from annotation-based @PermissionsAllowed to programmatic setup and forgetting to add the actual permission objects.","solutions":["Pass at least one Permission instance, e.g. .permissions(new Permission(\"read\", \"resource\")).","Only attach the permissions policy when at least one permission exists; otherwise choose permit/authenticated.","Inspect the code producing the Permission[] - guard against empty collections before toArray."],"exampleFix":"// before\nPermission[] perms = loadPermissions(); // may be empty\nhttpSecurity.path(\"/admin/*\").permissions(perms);\n// after\nif (perms != null && perms.length > 0) {\n    httpSecurity.path(\"/admin/*\").permissions(perms);\n}","handlingStrategy":"validation","validationCode":"if (permissions != null && permissions.length > 0) {\n    httpSecurity.path(path).permissions(permissions);\n}","typeGuard":"static boolean hasPermissions(Permission... permissions) {\n    return permissions != null && permissions.length > 0;\n}","tryCatchPattern":"try {\n    httpSecurity.path(\"/admin/*\").permissions(perms);\n} catch (IllegalArgumentException e) {\n    log.error(\"permissions() requires at least one Permission: \" + e.getMessage());\n}","preventionTips":["Guard collection-to-array conversions for emptiness before calling permissions().","Choose an alternative policy (permit/authenticated) when no permissions exist.","Keep permission construction and attachment in one place so emptiness is checked once."],"tags":["quarkus","http-security","permissions","argument-validation"],"backgroundTag":"empty-argument-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}