{"record":{"id":"e6012e02ed456309","repo":"apache/cassandra","slug":"role-name-can-t-be-an-empty-string","errorCode":null,"errorMessage":"Role name can't be an empty string","messagePattern":"Role name can't be an empty string","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/CreateRoleStatement.java","lineNumber":81,"sourceCode":"        this.cidrPermissions = cidrPermissions;\n        this.ifNotExists = ifNotExists;\n    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        super.checkPermission(state, Permission.CREATE, RoleResource.root());\n        if (opts.getSuperuser().isPresent())\n        {\n            if (opts.getSuperuser().get() && !state.getUser().isSuper())\n                throw new UnauthorizedException(\"Only superusers can create a role with superuser status\");\n        }\n    }\n\n    public void validate(ClientState state) throws RequestValidationException\n    {\n        opts.validate();\n        if (role.getRoleName().isEmpty())\n            throw new InvalidRequestException(\"Role name can't be an empty string\");\n\n        if (dcPermissions != null)\n        {\n            dcPermissions.validate();\n        }\n\n        if (cidrPermissions != null)\n        {\n            cidrPermissions.validate();\n        }\n\n        // validate login here before authorize to avoid leaking role existence to anonymous users.\n        state.ensureNotAnonymous();\n\n        if (!ifNotExists && role != RoleResource.GENERATED_ROLE && DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            throw new InvalidRequestException(String.format(\"%s already exists\", role.getRoleName()));\n    }\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/CreateRoleStatement.java#L63-L99","documentation":"CreateRoleStatement.validate rejects CREATE ROLE statements whose role name is the empty string, because role names are used as identifiers in RoleResource and authentication tables and an empty name would be unusable/ambiguous.","triggerScenarios":"Executing CREATE ROLE '' ... — the parsed role name has length 0.","commonSituations":"Templated provisioning scripts where a role-name variable is unset/empty; application code interpolating user-supplied names without trimming/validating; copy-paste errors leaving the quoted name blank.","solutions":["Supply a non-empty role name in the CREATE ROLE statement.","Validate/trim the name in application code before issuing CQL.","If names come from config or templates, fail fast when the placeholder resolves to empty."],"exampleFix":"// before\nString cql = String.format(\"CREATE ROLE '%s' WITH LOGIN = true\", cfg.getRoleName()); // roleName=\"\"\n// after\nif (cfg.getRoleName() == null || cfg.getRoleName().trim().isEmpty()) throw new IllegalArgumentException(\"role name required\");\nString cql = String.format(\"CREATE ROLE '%s' WITH LOGIN = true\", cfg.getRoleName().trim());","handlingStrategy":"validation","validationCode":"function assertValidRoleName(name) {\n  if (typeof name !== 'string' || name.trim().length === 0) throw new Error('role name must be a non-empty string');\n}","typeGuard":"function isNonEmptyString(v) { return typeof v === 'string' && v.trim().length > 0; }","tryCatchPattern":"try { session.execute(cql); } catch (InvalidRequestException e) { if (e.getMessage().contains(\"Role name can't be an empty string\")) { /* fix the templated name input */ } else throw e; }","preventionTips":["Validate/trim role-name inputs before building CQL strings","Fail fast on unset template/config placeholders","Add unit tests for provisioning code with empty/whitespace names"],"tags":["cql","roles","validation"],"backgroundTag":"empty-required-field","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}