{"record":{"id":"e42d3b5158f8a2c7","repo":"apache/cassandra","slug":"s-must-be-positive","errorCode":null,"errorMessage":"%s must be positive.","messagePattern":"(.+?) must be positive\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java","lineNumber":165,"sourceCode":"\n        specialsWarn = config.resolveInteger(SPECIAL_WARN_KEY, DEFAULT_SPECIAL_WARN);\n        specialsFail = config.resolveInteger(SPECIAL_FAIL_KEY, DEFAULT_SPECIAL_FAIL);\n\n        illegalSequenceLength = config.resolveInteger(ILLEGAL_SEQUENCE_LENGTH_KEY, DEFAULT_ILLEGAL_SEQUENCE_LENGTH);\n        dictionary = config.resolveString(DICTIONARY_KEY);\n        detailedMessages = config.resolveBoolean(DETAILED_MESSAGES_KEY, true);\n\n        validateParameters();\n    }\n\n    ConfigurationException mustBePositiveException(String parameter)\n    {\n        throw new ConfigurationException(parameter + \" must be positive.\");\n    }\n\n    public void validateParameters() throws ConfigurationException\n    {\n        if (maxLength < 0) throw mustBePositiveException(MAX_LENGTH_KEY);\n        if (characteristicsWarn < 0) throw mustBePositiveException(CHARACTERISTIC_WARN_KEY);\n        if (characteristicsFail < 0) throw mustBePositiveException(CHARACTERISTIC_FAIL_KEY);\n        if (lowerCaseWarn < 0) throw mustBePositiveException(LOWER_CASE_WARN_KEY);\n        if (lowerCaseFail < 0) throw mustBePositiveException(LOWER_CASE_FAIL_KEY);\n        if (upperCaseWarn < 0) throw mustBePositiveException(UPPER_CASE_WARN_KEY);\n        if (upperCaseFail < 0) throw mustBePositiveException(UPPER_CASE_FAIL_KEY);\n        if (specialsWarn < 0) throw mustBePositiveException(SPECIAL_WARN_KEY);\n        if (specialsFail < 0) throw mustBePositiveException(SPECIAL_FAIL_KEY);\n        if (digitsWarn < 0) throw mustBePositiveException(DIGIT_WARN_KEY);\n        if (digitsFail < 0) throw mustBePositiveException(DIGIT_FAIL_KEY);\n        if (lengthWarn < 0) throw mustBePositiveException(LENGTH_WARN_KEY);\n        if (lengthFail < 0) throw mustBePositiveException(LENGTH_FAIL_KEY);\n\n        if (MAX_LENGTH < maxLength)\n            throw new ConfigurationException(format(\"%s can not be greater than %s\",\n                                                    MAX_LENGTH_KEY,\n                                                    MAX_LENGTH));\n","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java#L147-L183","documentation":"This ConfigurationException is thrown by CassandraPasswordConfiguration.validateParameters when the max_length password guardrail setting resolves to a negative integer. Password guardrail configuration parameters must be non-negative because they represent thresholds (character counts); a negative value is meaningless and rejected at construction time when the guardrail is loaded from CustomGuardrailConfig.","triggerScenarios":"Setting the `max_length` key to a negative integer in the password guardrail configuration (cassandra.yaml guardrails section or guardrail config map) and then instantiating CassandraPasswordConfiguration; calling validateParameters() after programmatically setting maxLength < 0.","commonSituations":"Typo in config where a negative sign slips in; operator copying a threshold value from another system where -1 means 'unlimited', which this implementation does not support; automated config generation producing -1 defaults; misunderstanding that 0 is allowed but negatives are not.","solutions":["Open cassandra.yaml (or the guardrail config source) and set `max_length` to a non-negative integer, e.g. max_length: 128.","If you intended 'no maximum', use a large positive sentinel value rather than a negative number, since the validation only accepts >= 0.","If the value comes from an environment variable or config generator, fix the source so it never emits negatives, and re-run validateParameters or restart the node."],"exampleFix":"// before (cassandra.yaml guardrail config)\nmax_length: -1\n\n// after\nmax_length: 128","handlingStrategy":"validation","validationCode":"int maxLength = resolveInt(\"max_length\", DEFAULT_MAX_LENGTH);\nif (maxLength < 0)\n    throw new IllegalArgumentException(\"max_length must be >= 0\");","typeGuard":null,"tryCatchPattern":"// startup config load\ntry {\n    new CassandraPasswordConfiguration(config);\n} catch (ConfigurationException e) {\n    logger.error(\"Invalid password guardrail config: {}\", e.getMessage());\n    throw e; // fail fast; do not start with broken guardrails\n}","preventionTips":["Validate guardrail YAML keys with a schema check (non-negative integers) before rollout.","Never use -1 as a 'disabled' sentinel for these settings; use 0 or omit the key.","Add a config linter/CI step for cassandra.yaml guardrail sections.","Test guardrail configuration changes on a staging node before production."],"tags":["guardrails","configuration","password-policy"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}