{"record":{"id":"c6427458f0412e21","repo":"apache/dubbo","slug":"invalid-url-password-without-username-c64274","errorCode":null,"errorMessage":"Invalid url, password without username!","messagePattern":"Invalid url, password without username!","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"dubbo-common/src/main/java/org/apache/dubbo/common/URLBuilder.java","lineNumber":133,"sourceCode":"        this.parameters = parameters != null ? parameters : new HashMap<>();\n        this.attributes = attributes != null ? attributes : new HashMap<>();\n    }\n\n    public static URLBuilder from(URL url) {\n        String protocol = url.getProtocol();\n        String username = url.getUsername();\n        String password = url.getPassword();\n        String host = url.getHost();\n        int port = url.getPort();\n        String path = url.getPath();\n        Map<String, String> parameters = new HashMap<>(url.getParameters());\n        Map<String, Object> attributes = new HashMap<>(url.getAttributes());\n        return new URLBuilder(protocol, username, password, host, port, path, parameters, attributes);\n    }\n\n    public ServiceConfigURL build() {\n        if (StringUtils.isEmpty(username) && StringUtils.isNotEmpty(password)) {\n            throw new IllegalArgumentException(\"Invalid url, password without username!\");\n        }\n        port = Math.max(port, 0);\n        // trim the leading \"/\"\n        int firstNonSlash = 0;\n        if (path != null) {\n            while (firstNonSlash < path.length() && path.charAt(firstNonSlash) == '/') {\n                firstNonSlash++;\n            }\n            if (firstNonSlash >= path.length()) {\n                path = \"\";\n            } else if (firstNonSlash > 0) {\n                path = path.substring(firstNonSlash);\n            }\n        }\n        return new ServiceConfigURL(protocol, username, password, host, port, path, parameters, attributes);\n    }\n\n    @Override","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/apache/dubbo/blob/3a3043227f5571d25eb2889de5bca22f2914843b/dubbo-common/src/main/java/org/apache/dubbo/common/URLBuilder.java#L115-L151","documentation":"Thrown by URLBuilder.build() when the assembled URL has a password but no username. URLBuilder enforces the same credential-pair rule as the URL constructors at the moment the immutable ServiceConfigURL is produced, so malformed credentials surface during URL building rather than at first use.","triggerScenarios":"Calling URLBuilder.setUsername(\"\") (or never setting username) while setPassword(...) is non-empty, then invoking build(); or copying a URL into a builder and clearing the username but leaving the password. The IllegalArgumentException is raised at build() time.","commonSituations":"Programmatic URL construction for dynamic registries/protocols where the username was conditionally set and ended up empty; clearing credentials partially during URL rewriting; templating that interpolates an empty username; transforming one URL into another and dropping userinfo incorrectly.","solutions":["Always set both username and password together, or clear both when authentication is not required.","Validate credentials on the builder before build(): if password is non-blank, require a non-blank username.","Source the credentials from a single Credential object so they cannot drift apart."],"exampleFix":"// before\nURL u = new URLBuilder().setProtocol(\"nacos\").setPassword(\"secret\").setHost(\"h\").setPort(8848).build(); // throws\n\n// after\nURL u = new URLBuilder().setProtocol(\"nacos\").setUsername(\"app\").setPassword(\"secret\").setHost(\"h\").setPort(8848).build();","handlingStrategy":"validation","validationCode":"// Validate on the builder before build()\nif ((username == null || username.isEmpty()) && password != null && !password.isEmpty()) {\n    throw new IllegalArgumentException(\"URLBuilder: password without username\");\n}\nurl = builder.build();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set username and password together from a single credential source.","Clear both credentials when authentication is unused.","Validate credentials in config loading, not at URL build time."],"tags":["url","urlbuilder","config","validation","credentials"],"backgroundTag":null,"analyzedSha":"3a3043227f5571d25eb2889de5bca22f2914843b","analyzedAt":"2026-08-14T00:43:19.853Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}