{"record":{"id":"f760e23ac8597969","repo":"grpc/grpc-java","slug":"authorization-policy-should-be-a-json-object-foun","errorCode":null,"errorMessage":"Authorization policy should be a JSON object. Found: null","messagePattern":"Authorization policy should be a JSON object\\. Found: null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java","lineNumber":169,"sourceCode":"          .addAllPrincipals(principals)\n          .build();\n      policies.put(name + \"_\" + policyName, policy);\n    }\n    return policies;\n  }\n\n  /** \n   * Translates a gRPC authorization policy in JSON string to Envoy RBAC policies.\n   * On success, will return one of the following -\n   * 1. One allow RBAC policy or,\n   * 2. Two RBAC policies, deny policy followed by allow policy.\n   * If the policy cannot be parsed or is invalid, an exception will be thrown.\n   */\n  public static List<RBAC> translate(String authorizationPolicy) \n            throws IllegalArgumentException, IOException {\n    Object jsonObject = JsonParser.parse(authorizationPolicy);\n    if (!(jsonObject instanceof Map)) {\n      throw new IllegalArgumentException(\n          \"Authorization policy should be a JSON object. Found: \"\n          + (jsonObject == null ? null : jsonObject.getClass()));\n    }\n    @SuppressWarnings(\"unchecked\")\n    Map<String, ?> json = (Map<String, ?>)jsonObject;\n    String name = JsonUtil.getString(json, \"name\");\n    if (name == null || name.isEmpty()) {\n      throw new IllegalArgumentException(\"\\\"name\\\" is absent or empty\");\n    }\n    List<RBAC> rbacs = new ArrayList<>();\n    List<Map<String, ?>> objects = JsonUtil.getListOfObjects(json, \"deny_rules\");\n    if (objects != null && !objects.isEmpty()) {\n      rbacs.add(\n          RBAC.newBuilder()\n          .setAction(Action.DENY)\n          .putAllPolicies(parseRules(objects, name))\n          .build());\n    }","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/grpc/grpc-java/blob/64daddc1f3d1975670f769f3e97bde8b2ba32d25/authz/src/main/java/io/grpc/authz/AuthorizationPolicyTranslator.java#L151-L187","documentation":"AuthorizationPolicyTranslator.translate() parses a JSON string representing a gRPC authorization policy. JsonParser.parse() can return null (or a non-Map scalar like a string/number) when the input is not a JSON object; since a valid policy must be an object with fields like 'name' and rules, translate() throws IllegalArgumentException immediately with the actual parsed type in the message.","triggerScenarios":"Calling AuthorizationPolicyTranslator.translate(policy) with a policy string that parses to null, or to a JSON scalar/array instead of an object — e.g. empty string, whitespace, \"null\", a bare quoted string, or a JSON array.","commonSituations":"Config file loaded empty or not interpolated (env var unset leading to literal 'null'), reading a YAML policy that parses to a scalar, truncating the file, or passing the wrong file's contents.","solutions":["Verify the policy string is non-empty and parses to a JSON object before calling translate: JsonParser.parse(policy) instanceof Map","Check the file/env-var source actually contains the policy JSON (print it before translating)","If the policy is YAML, convert it to JSON first; gRPC authz policies must be JSON objects","Wrap translate() in try-catch for IllegalArgumentException and surface a clear config-loading error"],"exampleFix":"// before\nList<RBAC> rbacs = AuthorizationPolicyTranslator.translate(policyJson);\n// after\nif (policyJson == null || policyJson.trim().isEmpty()) {\n  throw new IllegalArgumentException(\"authorization policy file is empty\");\n}\nList<RBAC> rbacs = AuthorizationPolicyTranslator.translate(policyJson);","handlingStrategy":"validation","validationCode":"Object parsed = JsonParser.parse(policyJson);\nif (!(parsed instanceof Map)) {\n  throw new IllegalArgumentException(\"policy must be a JSON object, got: \" + parsed);\n}","typeGuard":"static boolean isJsonObject(String s) {\n  try { return JsonParser.parse(s) instanceof Map; } catch (Exception e) { return false; }\n}","tryCatchPattern":"try {\n  List<RBAC> rbacs = AuthorizationPolicyTranslator.translate(policyJson);\n} catch (IllegalArgumentException e) {\n  log.error(\"Invalid authorization policy: \" + e.getMessage());\n  throw new ConfigException(\"Bad authz policy\", e);\n}","preventionTips":["Assert the policy string is non-empty before translating","Validate the JSON parses to an object before calling the library","Log the raw policy source (file/env var) when translation fails","Keep authz policies in dedicated, path-checked files"],"tags":["grpc","authz","json","config"],"backgroundTag":"invalid-json-response","analyzedSha":"64daddc1f3d1975670f769f3e97bde8b2ba32d25","analyzedAt":"2026-09-08T06:14:57.704Z","contentChangedAt":"2026-09-08T06:14:57.704Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}