apple/pkl · error · IllegalStateException

Cannot call both `setSecurityManager` and…

Error message

Cannot call both `setSecurityManager` and `setAllowedModules`, because both define security manager settings.

What it means

Guard in EvaluatorBuilder.setAllowedModules: it throws IllegalStateException when a custom SecurityManager was already supplied via setSecurityManager. The two APIs are mutually exclusive ways of defining module-access security; mixing them would make the effective policy ambiguous, so the builder refuses the combination instead of silently merging rules.

Solutions

1. Encode the module allow-list inside the custom SecurityManager instead of calling setAllowedModules.
2. Drop setSecurityManager and rely on setAllowedModules alone for module access control.

When it happens

Trigger: Thrown at pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java:201 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/b6a1f44cde2de8ef. Report an issue: GitHub.

Appendix: source

Thrown at pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java:201

  public EvaluatorBuilder unsetSecurityManager() {
    this.securityManager = null;
    return this;
  }

  /** Returns the currently set security manager. */
  public @Nullable SecurityManager getSecurityManager() {
    return securityManager;
  }

  /**
   * Sets the set of URI patterns to be allowed when importing modules.
   *
   * @throws IllegalStateException if {@link #setSecurityManager(SecurityManager)} was also called.
   */
  public EvaluatorBuilder setAllowedModules(Collection<Pattern> patterns) {
    if (securityManager != null) {
      throw new IllegalStateException(
          "Cannot call both `setSecurityManager` and `setAllowedModules`, because both define security manager settings.");
    }
    securityManagerBuilder.setAllowedModules(patterns);
    return this;
  }

  /** Returns the set of patterns to be allowed when importing modules. */
  public List<Pattern> getAllowedModules() {
    return securityManagerBuilder.getAllowedModules();
  }

  /**
   * Sets the set of URI patterns to be allowed when reading resources.
   *
   * @throws IllegalStateException if {@link #setSecurityManager(SecurityManager)} was also called.
   */
  public EvaluatorBuilder setAllowedResources(Collection<Pattern> patterns) {
    if (securityManager != null) {

View on GitHub (pinned to f3efcbfc9b)