{"record":{"id":"ee5ba04fff04a78d","repo":"apache/hadoop","slug":"ipaddress-is-null","errorCode":null,"errorMessage":"ipAddress is null.","messagePattern":"ipAddress is null\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/MachineList.java","lineNumber":152,"sourceCode":"      entries = Collections.emptyList();\n    }\n  }\n  /**\n   * Accepts an ip address and return true if ipAddress is in the list.\n   * {@link #includes(InetAddress)} should be preferred\n   * to avoid possibly re-resolving the ip address.\n   *\n   * @param ipAddress ipAddress.\n   * @return true if ipAddress is part of the list\n   */\n  public boolean includes(String ipAddress) {\n    \n    if (all) {\n      return true;\n    }\n    \n    if (ipAddress == null) {\n      throw new IllegalArgumentException(\"ipAddress is null.\");\n    }\n\n    try {\n      return includes(addressFactory.getByName(ipAddress));\n    } catch (UnknownHostException e) {\n      return false;\n    }\n  }\n\n  /**\n   * Accepts an inet address and return true if address is in the list.\n   * @param address address.\n   * @return true if address is part of the list\n   */\n  public boolean includes(InetAddress address) {\n    if (all) {\n      return true;\n    }","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/MachineList.java#L134-L170","documentation":"MachineList evaluates whether a client host matches a configured list of addresses/CIDR ranges (used for host allow lists such as proxyuser restrictions). In includes(String), when the list is not the wildcard '*' (all) and ipAddress is null, it throws IllegalArgumentException(\"ipAddress is null.\") before any DNS resolution. With a '*' list the method returns true for anything, so the throw only occurs for concrete lists.","triggerScenarios":"includes((String) null) against a non-'*' list; calling with a remote-address variable that was never populated — typically an X-Forwarded-For header absent behind a proxy or a test invocation with no remote address.","commonSituations":"Filter/handler code reading a header the proxy did not send; refactors that changed where the address comes from; unit tests passing null directly.","solutions":["Null/empty-check the address and fail closed (deny) before calling includes()","Fall back to request.getRemoteAddr() when the primary header is missing","Fix the fronting proxy to always send the expected header"],"exampleFix":"// before\nString ip = request.getHeader(\"X-Forwarded-For\");\nif (machineList.includes(ip)) { allow(); }\n\n// after\nString ip = request.getHeader(\"X-Forwarded-For\");\nif (ip == null || ip.isEmpty()) ip = request.getRemoteAddr();\nif (ip != null && machineList.includes(ip)) { allow(); } else { deny(); }","handlingStrategy":"validation","validationCode":"String remote = request.getHeader(\"X-Forwarded-For\");\nif (remote == null || remote.trim().isEmpty()) remote = request.getRemoteAddr();\nboolean allowed = remote != null && machineList.includes(remote);","typeGuard":null,"tryCatchPattern":"try { allowed = machineList.includes(remote); } catch (IllegalArgumentException e) { allowed = false; /* fail closed on null/blank address */ }","preventionTips":["Fail closed when the client address cannot be established","Always pair header reads with a getRemoteAddr() fallback","Unit-test the filter with a missing header"],"tags":["hadoop","java","acl","null-check","host-filter"],"backgroundTag":"null-argument-validation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}