{"record":{"id":"cc29059b569cbcc2","repo":"apache/beam","slug":"constructor-method-namefrompayload-needs-to-be-explicitly","errorCode":null,"errorMessage":"Constructor method ${nameFromPayload} needs to be explicitly allowed","messagePattern":"Constructor method (.+?) needs to be explicitly allowed","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"sdks/java/expansion-service/src/main/java/org/apache/beam/sdk/expansion/service/JavaClassLookupTransformProvider.java","lineNumber":434,"sourceCode":"      throw new RuntimeException(\n          \"Could not find a matching constructor. When using field names, make sure they are \"\n              + \"available in the compiled Java class.\");\n    } else if (mappingConstructors.size() != 1) {\n      throw new RuntimeException(\n          \"Expected to find a single mapping constructor but found \" + mappingConstructors.size());\n    }\n    return (Constructor<PTransform<InputT, OutputT>>) mappingConstructors.get(0);\n  }\n\n  private boolean isConstructorMethodForName(\n      Method method, String nameFromPayload, AllowedClass allowListClass) {\n    for (Annotation annotation : method.getAnnotations()) {\n      if (annotation instanceof MultiLanguageConstructorMethod) {\n        if (nameFromPayload.equals(((MultiLanguageConstructorMethod) annotation).name())) {\n          if (allowListClass.isAllowedConstructorMethod(nameFromPayload)) {\n            return true;\n          } else {\n            throw new RuntimeException(\n                \"Constructor method \" + nameFromPayload + \" needs to be explicitly allowed\");\n          }\n        }\n      }\n    }\n    if (method.getName().equals(nameFromPayload)) {\n      if (allowListClass.isAllowedConstructorMethod(nameFromPayload)) {\n        return true;\n      } else {\n        throw new RuntimeException(\n            \"Constructor method \" + nameFromPayload + \" needs to be explicitly allowed\");\n      }\n    }\n    return false;\n  }\n\n  private Method findMappingConstructorMethod(\n      Method[] methods, JavaClassLookupPayload payload, AllowedClass allowListClass) {","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/apache/beam/blob/12126d8942aaf848030c478b4c6a28c6af861c66/sdks/java/expansion-service/src/main/java/org/apache/beam/sdk/expansion/service/JavaClassLookupTransformProvider.java#L416-L452","documentation":"The class declares a constructor method via @MultiLanguageConstructorMethod(name=...), but that name is not present in the expansion service's allowlist (isAllowedConstructorMethod). As a security guard against arbitrary code invocation, the provider throws RuntimeException instead of using the method.","triggerScenarios":"isConstructorMethodForName matches an annotated method whose name equals payload.getConstructorMethod(), but the allowlist configured for the expansion service does not include that name.","commonSituations":"Deploying a new transform whose constructor method was added but the service's allowlist config was not updated; hardened expansion-service deployments that require explicit allowlisting; allowlist key typos.","solutions":["Add the constructor method name to the expansion service's allowed constructor method configuration.","Redeploy/restart the expansion service so the updated allowlist is loaded.","If the method should not be restricted, ensure the annotation name matches the allowlist entry exactly (case-sensitive).","Catch RuntimeException and return guidance to add the method to the allowlist."],"exampleFix":"// before (service config)\nallowedConstructorMethods: []\n// after\nallowedConstructorMethods:\n  - myCustomConstructor","handlingStrategy":"validation","validationCode":"if (!allowListClass.isAllowedConstructorMethod(\"myCustomConstructor\")) throw new IllegalStateException(\"Add 'myCustomConstructor' to the expansion service allowlist\");","typeGuard":null,"tryCatchPattern":"try { method(payload, allowList); } catch (RuntimeException e) { if (e.getMessage().endsWith(\"needs to be explicitly allowed\")) { /* fail with allowlist instructions */ } throw e; }","preventionTips":["Maintain the allowlist alongside the transform registry","Validate allowlist entries at service startup","Use stable @MultiLanguageConstructorMethod names","Document the allowlist requirement for transform authors"],"tags":["java","security","allowlist","beam-expansion"],"backgroundTag":"permission-denied","analyzedSha":"12126d8942aaf848030c478b4c6a28c6af861c66","analyzedAt":"2026-09-13T01:50:10.254Z","contentChangedAt":"2026-09-13T01:50:10.254Z","schemaVersion":2},"datasetVersion":"2026-09-20T03:17:13.778Z"}