{"record":{"id":"c1e9fc93630380fd","repo":"quarkusio/quarkus","slug":"argument-method-cannot-be-null","errorCode":null,"errorMessage":"Argument 'method' cannot be null","messagePattern":"Argument 'method' cannot be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java","lineNumber":145,"sourceCode":"        }\n\n        /**\n         * @param newHeaders {@link CORSConfig#headers()}\n         * @return this builder\n         */\n        public Builder headers(Set<String> newHeaders) {\n            this.headers = merge(this.headers, newHeaders, \"Headers\");\n            return this;\n        }\n\n        /**\n         * This method is a shortcut for {@code methods(Set.of(method))}.\n         *\n         * @return this builder\n         */\n        public Builder method(String method) {\n            if (method == null) {\n                throw new IllegalArgumentException(\"Argument 'method' cannot be null\");\n            }\n            return methods(Set.of(method));\n        }\n\n        /**\n         * @param newMethods {@link CORSConfig#methods()}\n         * @return this builder\n         */\n        public Builder methods(Set<String> newMethods) {\n            this.methods = merge(this.methods, newMethods, \"Methods\");\n            return this;\n        }\n\n        /**\n         * This method is a shortcut for {@code origins(Set.of(origin))}.\n         *\n         * @return this builder\n         */","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java#L127-L163","documentation":"CORS.Builder.method(String) rejects a null argument with an IllegalArgumentException before delegating to methods(Set.of(method)). A null is not a valid HTTP method for the Access-Control-Allow-Methods configuration.","triggerScenarios":"Calling CORS.builder().method(null), often when method names are derived from config or user input.","commonSituations":"Unset config entries; splitting/parsing a method list that yields a null element; misordered builder arguments.","solutions":["Pass a non-null HTTP method name (e.g. \"POST\")","Null-check the value before calling","Validate the config source supplying the method name"],"exampleFix":"// before\nbuilder.method(props.getProperty(\"method\"));\n// after\nString m = props.getProperty(\"method\");\nif (m != null) {\n    builder.method(m);\n}","handlingStrategy":"validation","validationCode":"if (method == null) { throw new IllegalStateException(\"HTTP method must be configured before builder.method()\"); }","typeGuard":"boolean isValidMethod(String m) { return m != null && m.matches(\"[A-Z]+(,[A-Z]+)*\"); }","tryCatchPattern":null,"preventionTips":["Validate method names come from a known enum/constant list","Never parse method lists without filtering nulls","Null-check config-derived values"],"tags":["quarkus","null-argument","cors","illegal-argument"],"backgroundTag":"null-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}