{"record":{"id":"dc26e70df65614e1","repo":"pentaho/pentaho-kettle","slug":"schema-string-cannot-be-null-or-empty","errorCode":null,"errorMessage":"Schema string cannot be null or empty","messagePattern":"Schema string cannot be null or empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"plugins/avro-format/core/src/main/java/org/pentaho/di/trans/steps/avro/AvroSchemaValidator.java","lineNumber":55,"sourceCode":"  static {\n    // Java code patterns that shouldn't be in schema fields\n    INJECTION_PATTERNS.add(Pattern.compile(\"Runtime\\\\.getRuntime\", Pattern.CASE_INSENSITIVE));\n    INJECTION_PATTERNS.add(Pattern.compile(\"exec\\\\s*\\\\(\", Pattern.CASE_INSENSITIVE));\n    INJECTION_PATTERNS.add(Pattern.compile(\"\\\\*\\\\s*/\", Pattern.DOTALL)); // */ comment close\n    INJECTION_PATTERNS.add(Pattern.compile(\"/\\\\s*\\\\*\", Pattern.DOTALL)); // /* comment open\n    INJECTION_PATTERNS.add(Pattern.compile(\"static\\\\s*\\\\{\", Pattern.CASE_INSENSITIVE)); // static block\n    INJECTION_PATTERNS.add(Pattern.compile(\"class\\\\s+\\\\w+\", Pattern.CASE_INSENSITIVE)); // class definition\n  }\n\n  /**\n   * Validates a schema string for potential code injection vulnerabilities.\n   * \n   * @param schemaString the schema JSON string to validate\n   * @throws IllegalArgumentException if the schema contains suspicious patterns\n   */\n  public static void validateSchema(String schemaString) throws IllegalArgumentException {\n    if (schemaString == null || schemaString.isEmpty()) {\n      throw new IllegalArgumentException(\"Schema string cannot be null or empty\");\n    }\n\n    try {\n      JsonNode schemaNode = mapper.readTree(schemaString);\n      if (schemaNode.isObject()) {\n        validateSchemaNode((ObjectNode) schemaNode);\n      }\n    } catch (IllegalArgumentException e) {\n      throw e;\n    } catch (Exception e) {\n      throw new IllegalArgumentException(\"Invalid schema JSON: \" + e.getMessage(), e);\n    }\n  }\n\n  /**\n   * Validates a schema node and all its fields for injection patterns.\n   * \n   * @param node the schema node to validate","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/avro-format/core/src/main/java/org/pentaho/di/trans/steps/avro/AvroSchemaValidator.java#L37-L73","documentation":"AvroSchemaValidator.validateSchema guards the Avro schema JSON string before parsing: a null or empty string is rejected with this IllegalArgumentException. It is a defensive security/robustness check so downstream parsing and injection scanning only run on real input.","triggerScenarios":"Calling validateSchema(null) or validateSchema(\"\") — e.g. a step config field for the schema left blank, or a variable substitution resolving to empty.","commonSituations":"The Avro schema field in the step dialog was never filled in; an environment variable or parameter intended to hold the schema is unset and substitutes to empty string.","solutions":["Set the schema JSON in the step configuration before running the transformation.","If using a variable/env for the schema, ensure it is defined and non-empty at runtime.","Add an explicit up-front check for blank schema input in the calling code or dialog validation.","Load the schema from a file/resource and verify its content length before validating."],"exampleFix":"// before\nAvroSchemaValidator.validateSchema(schemaString); // throws if empty\n// after\nif (schemaString == null || schemaString.trim().isEmpty()) {\n  throw new IllegalArgumentException(\"Avro schema must be provided in step settings\");\n}\nAvroSchemaValidator.validateSchema(schemaString);","handlingStrategy":"validation","validationCode":"public static void requireSchema(String s) {\n  if (s == null || s.trim().isEmpty()) {\n    throw new IllegalArgumentException(\"Avro schema string must be provided and non-empty\");\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  AvroSchemaValidator.validateSchema(schemaString);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"null or empty\")) {\n    throw new IllegalStateException(\"Schema not configured in step settings\");\n  }\n  throw e;\n}","preventionTips":["Fill in the schema field in the step dialog; don't leave defaults.","Check that variables/env vars holding the schema resolve to non-empty values.","Load schemas from files/resources and assert non-empty content before use."],"tags":["avro","validation","schema","empty-input"],"backgroundTag":"empty-required-field","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}