{"record":{"id":"f03243ba059382e8","repo":"jstedfast/MailKit","slug":"password","errorCode":null,"errorMessage":"password","messagePattern":"password","errorType":"validation","errorClass":"ArgumentNullException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs","lineNumber":54,"sourceCode":"\t\tstatic readonly byte[] Z16 = new byte[16];\n\n\t\treadonly NtlmNegotiateMessage? negotiate;\n\t\treadonly NtlmChallengeMessage? challenge;\n\t\tbyte[] clientChallenge;\n\n\t\tpublic NtlmAuthenticateMessage (NtlmNegotiateMessage negotiate, NtlmChallengeMessage challenge, string userName, string password, string domain, string workstation) : base (3)\n\t\t{\n\t\t\tif (negotiate == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (negotiate));\n\n\t\t\tif (challenge == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (challenge));\n\n\t\t\tif (userName == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (userName));\n\n\t\t\tif (password == null)\n\t\t\t\tthrow new ArgumentNullException (nameof (password));\n\n\t\t\tclientChallenge = NtlmUtils.NONCE (8);\n\t\t\tthis.negotiate = negotiate;\n\t\t\tthis.challenge = challenge;\n\n\t\t\tif (!string.IsNullOrEmpty (domain)) {\n\t\t\t\tDomain = domain;\n\t\t\t} else if ((challenge.Flags & NtlmFlags.TargetTypeDomain) != 0) {\n\t\t\t\t// The server is domain-joined, so the TargetName will be the domain.\n\t\t\t\tDomain = challenge.TargetName ?? string.Empty;\n\t\t\t} else if (challenge.TargetInfo != null) {\n\t\t\t\t// The server is not domain-joined, so the TargetName will be the machine name of the server.\n\t\t\t\tDomain = challenge.TargetInfo.DomainName ?? string.Empty;\n\t\t\t} else {\n\t\t\t\tDomain = string.Empty;\n\t\t\t}\n\n\t\t\tWorkstation = workstation;","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs#L36-L72","documentation":"The NtlmAuthenticateMessage constructor throws ArgumentNullException when password is null. The password is required to derive the NTLM/NTLMv2 hash used to compute the response, so it must be non-null.","triggerScenarios":"Calling new NtlmAuthenticateMessage(negotiate, challenge, userName, null, domain, workstation) — typically a missing credential in config, a keychain lookup returning null, or a CredentialCache miss.","commonSituations":"Password not loaded from configuration/environment; using cached credentials that were never stored; API changes where the password field was renamed.","solutions":["Pass a non-null password (string.Empty if intentionally blank).","Ensure credentials are fetched/populated before constructing the message.","Null-check the password and surface a clear configuration error to the user instead of the raw ArgumentNullException."],"exampleFix":"// before\nvar auth = new NtlmAuthenticateMessage(negotiate, challenge, user, null, domain, ws);\n// after\nif (password == null) throw new InvalidOperationException(\"NTLM password was not configured.\");\nvar auth = new NtlmAuthenticateMessage(negotiate, challenge, user, password, domain, ws);","handlingStrategy":"validation","validationCode":"if (password == null) throw new InvalidOperationException(\"NTLM password is not configured.\");\nvar auth = new NtlmAuthenticateMessage(negotiate, challenge, userName, password, domain, workstation);","typeGuard":"static bool HasPassword(string password) => password != null; // empty string is legal","tryCatchPattern":"try {\n\tauth = new NtlmAuthenticateMessage(negotiate, challenge, userName, password, domain, workstation);\n} catch (ArgumentNullException ex) when (ex.ParamName == \"password\") {\n\t// re-fetch credentials from the secure store before retrying\n\tpassword = credentialStore.Get(userName) ?? string.Empty;\n}","preventionTips":["Populate credentials from config/env/secret store before constructing auth messages.","Never pass through null from failed credential lookups; convert to a clear configuration error.","Keep password in non-nullable string fields where possible so the compiler flags unassigned paths."],"tags":["null-argument","csharp","ntlm","credentials"],"backgroundTag":"null-argument","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}