What causes "Port out of range. Expected [0, %s], actual %s." in google/tsunami-security-scanner?

Set each port to an integer between 1 and 65535.

google/tsunami-security-scanner · error · ParameterException

Port out of range. Expected

Error message

Port out of range. Expected [0, %s], actual %s.

What it means

LanguageServerOptions.validate() parses each --plugin-server-port value as an integer and requires it to be within (0, NetworkEndpointUtils.MAX_PORT_NUMBER]. Ports outside this range cannot be bound and trigger this ParameterException.

Solutions

Set each port to an integer between 1 and 65535.
Pre-validate ports with a regex/range check in your deployment script before launching Tsunami.
If you need dynamic ports, allocate a free port externally first and pass it explicitly.

Example fix

// before
--plugin-server-port=70000
// after
--plugin-server-port=8080

Defensive patterns

Strategy: validation

Validate before calling

boolean validPort(String p) { try { int v = Integer.parseInt(p.trim()); return v > 0 && v <= 65535; } catch (NumberFormatException e) { return false; } }

Try / catch

try { options.validate(); } catch (ParameterException e) { log.error("Port config invalid: {}", e.getMessage()); }

Prevention

Restrict ports to 1-65535 in config generation.
Do not use 0 for ephemeral ports.
Validate all ports in CI before deployment.

When it happens

Trigger: Passing --plugin-server-port with a value like 0, -1, 70000, or 99999 while the value still parses as an integer.

Common situations: Typos in port numbers, using 0 expecting an ephemeral port assignment (not supported), or copying a 5-digit internal port that exceeds 65535.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of google/tsunami-security-scanner@363ba87b35 (2026-09-13). Data as JSON: /api/errors/50dd7cb88b2772a1. Report an issue: GitHub.

Appendix: source

Thrown at main/src/main/java/com/google/tsunami/main/cli/LanguageServerOptions.java:82

  @Override
  public void validate() {
    if (!pluginServerFilenames.isEmpty() || !pluginServerPorts.isEmpty()) {
      if (pluginServerFilenames != null && !pluginServerFilenames.isEmpty()) {
        for (String pluginServerFilename : pluginServerFilenames) {
          if (!Files.exists(Paths.get(pluginServerFilename))) {
            throw new ParameterException(
                String.format("Language server path %s does not exist", pluginServerFilename));
          }
        }
      }

      if (pluginServerPorts != null && !pluginServerPorts.isEmpty()) {
        for (String pluginServerPort : pluginServerPorts) {
          try {
            int port = Integer.parseInt(pluginServerPort);
            if (!(port <= NetworkEndpointUtils.MAX_PORT_NUMBER && port > 0)) {
              throw new ParameterException(
                  String.format(
                      "Port out of range. Expected [0, %s], actual %s.",
                      NetworkEndpointUtils.MAX_PORT_NUMBER, pluginServerPort));
            }
          } catch (NumberFormatException e) {
            throw new ParameterException(
                String.format("Port number must be an integer. Got %s instead.", pluginServerPort),
                e);
          }
        }
      }

      var pathCounts = pluginServerFilenames == null ? 0 : pluginServerFilenames.size();
      var portCounts = pluginServerPorts == null ? 0 : pluginServerPorts.size();
      if (pathCounts != portCounts) {
        throw new ParameterException(
            String.format(
                "Number of plugin server paths must be equal to number of plugin server ports."

View on GitHub (pinned to 363ba87b35)