{"record":{"id":"e60ecab936517fa7","repo":"apache/hadoop","slug":"mode-cannot-be-null","errorCode":null,"errorMessage":"mode cannot be NULL","messagePattern":"mode cannot be NULL","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java","lineNumber":143,"sourceCode":"  private SSLSocketFactory socketFactory;\n  private HostnameVerifier hostnameVerifier;\n  private KeyStoresFactory keystoresFactory;\n\n  private String[] enabledProtocols = null;\n  private List<String> excludeCiphers;\n  private List<String> includeCiphers;\n\n  /**\n   * Creates an SSLFactory.\n   *\n   * @param mode SSLFactory mode, client or server.\n   * @param conf Hadoop configuration from where the SSLFactory configuration\n   * will be read.\n   */\n  public SSLFactory(Mode mode, Configuration conf) {\n    this.conf = conf;\n    if (mode == null) {\n      throw new IllegalArgumentException(\"mode cannot be NULL\");\n    }\n    this.mode = mode;\n    Configuration sslConf = readSSLConfiguration(conf, mode);\n\n    requireClientCert = sslConf.getBoolean(SSL_REQUIRE_CLIENT_CERT_KEY,\n        SSL_REQUIRE_CLIENT_CERT_DEFAULT);\n\n    Class<? extends KeyStoresFactory> klass\n      = conf.getClass(KEYSTORES_FACTORY_CLASS_KEY,\n                      FileBasedKeyStoresFactory.class, KeyStoresFactory.class);\n    keystoresFactory = ReflectionUtils.newInstance(klass, sslConf);\n\n    enabledProtocols = conf.getStrings(SSL_ENABLED_PROTOCOLS_KEY,\n        SSL_ENABLED_PROTOCOLS_DEFAULT);\n    excludeCiphers = Arrays.asList(\n        sslConf.getTrimmedStrings(SSL_SERVER_EXCLUDE_CIPHER_LIST));\n    includeCiphers = Arrays.asList(\n      sslConf.getTrimmedStrings(SSL_SERVER_INCLUDE_CIPHER_LIST));","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/ssl/SSLFactory.java#L125-L161","documentation":"The SSLFactory constructor requires an explicit Mode (CLIENT or SERVER); passing null throws IllegalArgumentException immediately. The mode decides which SSL configuration file (client vs server) and which keystore properties are resolved, so a null mode is a programming error.","triggerScenarios":"new SSLFactory(null, conf); a mode variable derived from config or a method parameter that was never initialized; conditional code that assigns mode only in some branches.","commonSituations":"Shared SSL helper classes where one caller forgot to pass the mode; refactors replacing an enum literal with a config-driven value that can be absent; unit tests constructing SSLFactory casually.","solutions":["Pass Mode.SERVER for server-side sockets and Mode.CLIENT for client-side connections","Default or validate the mode before construction when it comes from configuration","Make the mode a required constructor parameter of your own wrapper so it cannot be omitted"],"exampleFix":"// before\nSSLFactory factory = new SSLFactory(modeFromConfig, conf); // may be null\n\n// after\nSSLFactory.Mode mode = SSLFactory.Mode.valueOf(\n    conf.get(\"my.tls.role\", \"CLIENT\").toUpperCase(Locale.ROOT));\nSSLFactory factory = new SSLFactory(mode, conf);","handlingStrategy":"validation","validationCode":"Objects.requireNonNull(mode, \"SSLFactory mode must be CLIENT or SERVER\");\nSSLFactory factory = new SSLFactory(mode, conf);","typeGuard":"private static SSLFactory.Mode resolveMode(String role) {\n  return \"server\".equalsIgnoreCase(role) ? SSLFactory.Mode.SERVER : SSLFactory.Mode.CLIENT;\n}","tryCatchPattern":null,"preventionTips":["Make mode a required parameter of any wrapper that builds SSLFactory","Never derive mode from nullable config without a default","Initialize mode at declaration: SSLFactory.Mode mode = SSLFactory.Mode.CLIENT;"],"tags":["ssl","tls","null-check","constructor","hadoop"],"backgroundTag":"null-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}