{"record":{"id":"d8ed1fd79a499843","repo":"apache/cassandra","slug":"denylist-max-keys-per-table-must-be-a-positive-int","errorCode":null,"errorMessage":"denylist_max_keys_per_table must be a positive integer.","messagePattern":"denylist_max_keys_per_table must be a positive integer\\.","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/config/DatabaseDescriptor.java","lineNumber":5572,"sourceCode":"    public static ConsistencyLevel getDenylistConsistencyLevel()\n    {\n        return conf.denylist_consistency_level;\n    }\n\n    public static void setDenylistConsistencyLevel(ConsistencyLevel cl)\n    {\n        conf.denylist_consistency_level = cl;\n    }\n\n    public static int getDenylistMaxKeysPerTable()\n    {\n        return conf.denylist_max_keys_per_table;\n    }\n\n    public static void setDenylistMaxKeysPerTable(int value)\n    {\n        if (value <= 0)\n            throw new IllegalArgumentException(\"denylist_max_keys_per_table must be a positive integer.\");\n        conf.denylist_max_keys_per_table = value;\n    }\n\n    public static int getDenylistMaxKeysTotal()\n    {\n        return conf.denylist_max_keys_total;\n    }\n\n    public static void setDenylistMaxKeysTotal(int value)\n    {\n        if (value <= 0)\n            throw new IllegalArgumentException(\"denylist_max_keys_total must be a positive integer.\");\n        conf.denylist_max_keys_total = value;\n    }\n\n    public static boolean getAuthCacheWarmingEnabled()\n    {\n        return conf.auth_cache_warming_enabled;","sourceCodeStart":5554,"sourceCodeEnd":5590,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/DatabaseDescriptor.java#L5554-L5590","documentation":"DatabaseDescriptor.setDenylistMaxKeysPerTable validates its argument before storing it in the runtime configuration. A value of zero or negative would disable or corrupt the denylist size accounting, so the setter rejects it with IllegalArgumentException. This guard exists because the value is a live-updatable config knob, not just a startup-time YAML field.","triggerScenarios":"Calling DatabaseDescriptor.setDenylistMaxKeysPerTable(0) or any negative int, either programmatically in tests/tools or via a JMX/config-management path that relays a bad value.","commonSituations":"Operators scripting configuration changes pass 0 thinking it means 'unlimited' or 'disabled'; YAML migrations or templating emit an empty/zero value; tooling subtracts values yielding negatives.","solutions":["Pass a positive integer (>= 1) to setDenylistMaxKeysPerTable.","Fix the value in cassandra.yaml or the config source feeding the setter.","If you intended to disable denylisting, use the dedicated enable/disable flag instead of setting the limit to 0."],"exampleFix":"// before\nDatabaseDescriptor.setDenylistMaxKeysPerTable(0);\n// after\nDatabaseDescriptor.setDenylistMaxKeysPerTable(1000);","handlingStrategy":"validation","validationCode":"if (value >= 1) DatabaseDescriptor.setDenylistMaxKeysPerTable(value);","typeGuard":"boolean isValidDenylistLimit(int v) { return v > 0; }","tryCatchPattern":"try { DatabaseDescriptor.setDenylistMaxKeysPerTable(value); } catch (IllegalArgumentException e) { log.error(\"bad denylist_max_keys_per_table\", e); }","preventionTips":["Never encode 'disabled' as 0; use the feature toggle.","Validate values parsed from YAML/templates before applying.","Clamp computed limits to >= 1 in scripts."],"tags":["configuration","validation","illegal-argument"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}