apple/pkl · error · IllegalStateException

Cannot call both `setSecurityManager` and…

Error message

Cannot call both `setSecurityManager` and `setAllowedResources`, because both define security manager settings.

What it means

Guard in EvaluatorBuilder.setAllowedResources: throws IllegalStateException when setSecurityManager has already been called. Resource-read rules would then be defined twice — by the custom SecurityManager and by the allowed-resource patterns — so the builder rejects the ambiguous configuration.

Solutions

1. Move the resource allow-list into the custom SecurityManager and do not call setAllowedResources.
2. Skip setSecurityManager and configure resource access with setAllowedResources only.

When it happens

Trigger: Thrown at pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java:220 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/9de3b6c7e117fd97. Report an issue: GitHub.

Appendix: source

Thrown at pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java:220

          "Cannot call both `setSecurityManager` and `setAllowedModules`, because both define security manager settings.");
    }
    securityManagerBuilder.setAllowedModules(patterns);
    return this;
  }

  /** Returns the set of patterns to be allowed when importing modules. */
  public List<Pattern> getAllowedModules() {
    return securityManagerBuilder.getAllowedModules();
  }

  /**
   * Sets the set of URI patterns to be allowed when reading resources.
   *
   * @throws IllegalStateException if {@link #setSecurityManager(SecurityManager)} was also called.
   */
  public EvaluatorBuilder setAllowedResources(Collection<Pattern> patterns) {
    if (securityManager != null) {
      throw new IllegalStateException(
          "Cannot call both `setSecurityManager` and `setAllowedResources`, because both define security manager settings.");
    }
    securityManagerBuilder.setAllowedResources(patterns);
    return this;
  }

  /** Returns the set of patterns to be allowed when reading resources. */
  public List<Pattern> getAllowedResources() {
    return securityManagerBuilder.getAllowedResources();
  }

  /**
   * Sets the root directory, which restricts access to file-based modules and resources located
   * under this directory.
   */
  public EvaluatorBuilder setRootDir(@Nullable Path rootDir) {
    securityManagerBuilder.setRootDir(rootDir);
    return this;

View on GitHub (pinned to f3efcbfc9b)