{"record":{"id":"f4bc5a28ae6a86eb","repo":"kestra-io/kestra","slug":"hashing-exception-encountered","errorCode":null,"errorMessage":"Hashing exception encountered\n","messagePattern":"Hashing exception encountered\n","errorType":"exception","errorClass":"PebbleException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/io/kestra/core/runners/pebble/filters/ShaBaseFilter.java","lineNumber":38,"sourceCode":"    @Override\n    public List<String> getArgumentNames() {\n        return null;\n    }\n\n    @Override\n    public Object apply(Object input, Map<String, Object> args, PebbleTemplate self,\n        EvaluationContext context, int lineNumber) throws PebbleException {\n        if (input == null) {\n            return null;\n        }\n\n        if (input instanceof String str) {\n            try {\n                MessageDigest digest = MessageDigest.getInstance(algorithm);\n                byte[] encodedHash = digest.digest((str).getBytes(StandardCharsets.UTF_8));\n                return bytesToHex(encodedHash);\n            } catch (Exception e) {\n                throw new PebbleException(e, \"Hashing exception encountered\\n\", lineNumber, self.getName());\n            }\n        } else {\n            throw new PebbleException(null, \"Need a string to hash\\n\", lineNumber, self.getName());\n        }\n    }\n\n    private static String bytesToHex(byte[] bytes) {\n        StringBuilder hexString = new StringBuilder(2 * bytes.length);\n        for (byte aByte : bytes) {\n            String hex = Integer.toHexString(0xff & aByte);\n            if (hex.length() == 1) {\n                hexString.append('0');\n            }\n            hexString.append(hex);\n        }\n        return hexString.toString();\n    }\n","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/kestra-io/kestra/blob/823fada9274c4f9c251ea0a516460a4f7d958032/core/src/main/java/io/kestra/core/runners/pebble/filters/ShaBaseFilter.java#L20-L56","documentation":"Thrown by the SHA filter family (sha1, sha256, sha512, etc., all extending ShaBaseFilter) when `MessageDigest.getInstance(algorithm)` or `digest.digest(...)` raises an exception. The original exception is attached as the cause; the message is a generic 'Hashing exception encountered'. On standard JVMs the SHA algorithms are always available, so this branch is essentially only reachable on stripped/custom JCE configurations.","triggerScenarios":"Running on a JVM or security provider that does not register the requested algorithm; a `NoSuchAlgorithmException` or a runtime fault during digesting (extremely rare). Could also occur if a subclass passes an unsupported algorithm string to the constructor.","commonSituations":"Custom JRE images (e.g. jlink minimised runtime) that exclude the SUN provider; embedded environments with restricted cryptography; a future subclass typo in the algorithm name.","solutions":["Inspect the wrapped cause in the stack trace (NoSuchAlgorithmException vs other).","Run on a standard JDK/JRE that includes the SUN security provider.","If using a custom runtime image, ensure the `java.security` provider list includes MessageDigest support for SHA-*.","Confirm the algorithm name is correct (e.g. 'SHA-256', not 'SHA256')."],"exampleFix":"# before\n{{ secret | sha256 }}\n# the call is correct; fix the runtime instead:\n# use a full JDK/JRE that includes the SUN provider\n# verify in a script task:\n#   MessageDigest.getInstance(\"SHA-256\") must not throw","handlingStrategy":"try-catch","validationCode":"# Verify algorithm availability in a script task before relying on the filter:\n# MessageDigest.getInstance(\"SHA-256\");  // throws NoSuchAlgorithmException on stripped runtimes\n# In Pebble, the call is correct; this is an environment issue:\n{{ secret | sha256 }}","typeGuard":null,"tryCatchPattern":"# In a script task (Java/Groovy), guard the digest:\n# try { MessageDigest.getInstance(\"SHA-256\"); }\n# catch (NoSuchAlgorithmException e) { /* fall back to a supported algorithm */ }","preventionTips":["Run on a standard JDK/JRE that bundles the SUN security provider.","If using a custom/jlink runtime, include MessageDigest support for SHA-*.","Use canonical algorithm names (e.g. 'SHA-256').","Surface and log the wrapped cause when this fires."],"tags":["pebble-filter","sha","hashing","message-digest","jce","environment"],"backgroundTag":null,"analyzedSha":"823fada9274c4f9c251ea0a516460a4f7d958032","analyzedAt":"2026-08-14T06:15:17.947Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}