{"record":{"id":"f08e6c745257425f","repo":"apache/cassandra","slug":"must-be-positive","errorCode":null,"errorMessage":" must be positive.","messagePattern":" must be positive\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java","lineNumber":160,"sourceCode":"        lowerCaseWarn = config.resolveInteger(LOWER_CASE_WARN_KEY, DEFAULT_LOWER_CASE_WARN);\n        lowerCaseFail = config.resolveInteger(LOWER_CASE_FAIL_KEY, DEFAULT_LOWER_CASE_FAIL);\n\n        digitsWarn = config.resolveInteger(DIGIT_WARN_KEY, DEFAULT_DIGIT_WARN);\n        digitsFail = config.resolveInteger(DIGIT_FAIL_KEY, DEFAULT_DIGIT_FAIL);\n\n        specialsWarn = config.resolveInteger(SPECIAL_WARN_KEY, DEFAULT_SPECIAL_WARN);\n        specialsFail = config.resolveInteger(SPECIAL_FAIL_KEY, DEFAULT_SPECIAL_FAIL);\n\n        illegalSequenceLength = config.resolveInteger(ILLEGAL_SEQUENCE_LENGTH_KEY, DEFAULT_ILLEGAL_SEQUENCE_LENGTH);\n        dictionary = config.resolveString(DICTIONARY_KEY);\n        detailedMessages = config.resolveBoolean(DETAILED_MESSAGES_KEY, true);\n\n        validateParameters();\n    }\n\n    ConfigurationException mustBePositiveException(String parameter)\n    {\n        throw new ConfigurationException(parameter + \" must be positive.\");\n    }\n\n    public void validateParameters() throws ConfigurationException\n    {\n        if (maxLength < 0) throw mustBePositiveException(MAX_LENGTH_KEY);\n        if (characteristicsWarn < 0) throw mustBePositiveException(CHARACTERISTIC_WARN_KEY);\n        if (characteristicsFail < 0) throw mustBePositiveException(CHARACTERISTIC_FAIL_KEY);\n        if (lowerCaseWarn < 0) throw mustBePositiveException(LOWER_CASE_WARN_KEY);\n        if (lowerCaseFail < 0) throw mustBePositiveException(LOWER_CASE_FAIL_KEY);\n        if (upperCaseWarn < 0) throw mustBePositiveException(UPPER_CASE_WARN_KEY);\n        if (upperCaseFail < 0) throw mustBePositiveException(UPPER_CASE_FAIL_KEY);\n        if (specialsWarn < 0) throw mustBePositiveException(SPECIAL_WARN_KEY);\n        if (specialsFail < 0) throw mustBePositiveException(SPECIAL_FAIL_KEY);\n        if (digitsWarn < 0) throw mustBePositiveException(DIGIT_WARN_KEY);\n        if (digitsFail < 0) throw mustBePositiveException(DIGIT_FAIL_KEY);\n        if (lengthWarn < 0) throw mustBePositiveException(LENGTH_WARN_KEY);\n        if (lengthFail < 0) throw mustBePositiveException(LENGTH_FAIL_KEY);\n","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/CassandraPasswordConfiguration.java#L142-L178","documentation":"Thrown as a ConfigurationException by CassandraPasswordConfiguration.mustBePositiveException when a numeric password-guardrail configuration parameter is set to a negative value. Several password-complexity thresholds (maxLength, warn/fail thresholds for characteristics, digits, length, etc.) must be positive, and validateParameters rejects any negative value with '<parameter> must be positive.'.","triggerScenarios":"Configuring cassandra.yaml password guardrails (or constructing CassandraPasswordConfiguration) with a negative value for any of MAX_LENGTH_KEY, CHARACTERISTIC_WARN_KEY, DIGIT_WARN/FAIL_KEY, LENGTH_WARN/FAIL_KEY, etc.","commonSituations":"Typos in cassandra.yaml (e.g. a stray minus sign); confusing '0 means disabled' semantics from other tools and entering -1 to disable; programmatic config generation producing negative defaults.","solutions":["Set the offending cassandra.yaml password-guardrail parameter to a positive integer","Remove the parameter to fall back to defaults instead of using a negative sentinel value","Restart/reload configuration and check the log line naming the exact offending key"],"exampleFix":"// before\ncassandra:\n  password_guardrails:\n    max_length: -1\n// after\ncassandra:\n  password_guardrails:\n    max_length: 128","handlingStrategy":"validation","validationCode":"List<String> keys = List.of(\"max_length\",\"characteristics_warn\",\"characteristics_fail\",\"digits_warn\",\"digits_fail\",\"length_warn\",\"length_fail\");\nfor (String k : keys)\n    if (config.getInt(\"password_guardrails.\" + k) < 0)\n        throw new ConfigurationException(k + \" must be positive.\");","typeGuard":null,"tryCatchPattern":"try { validateGuardrailConfig(cfg); }\ncatch (ConfigurationException e) {\n    logger.error(\"Bad password guardrail config: {}\", e.getMessage());\n    throw e; // fail fast at startup\n}","preventionTips":["Lint cassandra.yaml guardrail values for negativity at deploy time","Never use negative numbers as 'disable' sentinels; omit keys instead","Log the exact offending key when configuration fails"],"tags":["configuration","guardrails","password"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}