{"record":{"id":"e5fbd308c842acfc","repo":"SonarSource/sonarqube","slug":"no-secret-key-in-the-file-path","errorCode":null,"errorMessage":"\"No secret key in the file: \" + path","messagePattern":"\"No secret key in the file: \" \\+ path","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java","lineNumber":78,"sourceCode":"    return false;\n  }\n\n  protected Key loadSecretFile() throws IOException {\n    String path = getPathToSecretKey();\n    return loadSecretFileFromFile(path);\n  }\n\n  Key loadSecretFileFromFile(@Nullable String path) throws IOException {\n    if (StringUtils.isBlank(path)) {\n      throw new IllegalStateException(\"Secret key not found. Please set the property \" + ENCRYPTION_SECRET_KEY_PATH);\n    }\n    File file = new File(path);\n    if (!file.exists() || !file.isFile()) {\n      throw new IllegalStateException(\"The property \" + ENCRYPTION_SECRET_KEY_PATH + \" does not link to a valid file: \" + path);\n    }\n    String s = FileUtils.readFileToString(file, UTF_8);\n    if (StringUtils.isBlank(s)) {\n      throw new IllegalStateException(\"No secret key in the file: \" + path);\n    }\n    return new SecretKeySpec(Base64.decodeBase64(StringUtils.trim(s)), CRYPTO_KEY);\n  }\n\n  String generateRandomSecretKey() {\n    try {\n      KeyGenerator keyGen = KeyGenerator.getInstance(CRYPTO_KEY);\n      keyGen.init(KEY_SIZE_IN_BITS, new SecureRandom());\n      SecretKey secretKey = keyGen.generateKey();\n      return Base64.encodeBase64String(secretKey.getEncoded());\n\n    } catch (Exception e) {\n      throw new IllegalStateException(\"Fail to generate secret key\", e);\n    }\n  }\n\n  String getPathToSecretKey() {\n    if (StringUtils.isBlank(pathToSecretKey)) {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java#L60-L96","documentation":"AesCipher.loadSecretFileFromFile throws this IllegalStateException when the secret key file exists and is readable but its content is empty or whitespace-only. AesCipher expects the file to contain a non-blank Base64-encoded AES key, so an empty file means the encryption setup was never completed properly.","triggerScenarios":"Calling loadSecretFile() with sonar.secretKeyPath pointing to a file that was created but never populated — e.g. an empty file created by touch, a failed/aborted key-generation step, or a file truncated by a bad write/mount.","commonSituations":"Operator created an empty placeholder file to silence a previous 'file not found' error; key generation script failed midway; Docker volume mount left the file empty; a provisioning tool wrote nothing to the file.","solutions":["Regenerate the secret key (Base64, 16 bytes for AES) and write it to the configured file, then restart SonarQube.","Verify the file is non-empty: cat the path from the exception and check it contains a Base64 key.","Ensure the key generation completed successfully (check logs of the encryption/secret-key step).","If using a mounted volume, confirm the mount actually contains the key, not an empty placeholder."],"exampleFix":"# before: empty file -> IllegalStateException\n$ touch /opt/sonarqube/conf/secret.key\n# after: write a valid Base64 secret key\n$ openssl rand -base64 16 > /opt/sonarqube/conf/secret.key","handlingStrategy":"validation","validationCode":"String content = FileUtils.readFileToString(new File(secretKeyPath), StandardCharsets.UTF_8);\nif (content.isBlank()) {\n  throw new IllegalStateException(\"Secret key file is empty: \" + secretKeyPath);\n}","typeGuard":null,"tryCatchPattern":"try {\n  Key key = aesCipher.loadSecretFile();\n} catch (IllegalStateException e) {\n  LOG.error(\"Regenerate the secret key file: \" + e.getMessage());\n}","preventionTips":["Never create placeholder secret key files; generate the key properly","Verify file content is non-empty Base64 after generation","Check volume mounts actually carry the key in containerized setups","Add a startup health check that validates the key file content"],"tags":["encryption","secret-key","empty-file","sonarqube"],"backgroundTag":"empty-required-field","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}