* (And even if annotations on local variables were permitted as an optional hint, no annotation
   * would be the right tool for the job here: {@code @Nullable} is the annotation that we're trying
   * to get rid of, and {@code @NonNull} would be wrong for our use case for the same reason as
   * {@code requireNonNull}: Our use case is the one in which {@code T} has parametric nullness—and

        // Constructor accepts null principal without throwing exception
        NtlmHttpServletRequest request = new NtlmHttpServletRequest(mockRequest, null);

        // getRemoteUser() will throw NPE when trying to call getName() on null principal
        assertThrows(NullPointerException.class, () -> request.getRemoteUser());
        assertNull(request.getUserPrincipal());
        assertEquals("NTLM", request.getAuthType());
    }

      this.a = "x";
      this.b = b;
    }

    // keep trying
    @Keep
    static GoodEquals create(int a, int b) {
      throw new RuntimeException();
    }

    // Good!
    static GoodEquals create(String a, int b) {
      return new GoodEquals(a, b);
    }

    // keep trying
    @Keep
    public static @Nullable GoodEquals createMayReturnNull(int a, int b) {

     * @param size the desired length of the resulting hex string (will be left-padded with zeros)
     * @return a hexadecimal string representation of the value, padded to the specified size
     */
    public static String toHexString(final int val, final int size) {
        final char[] c = new char[size];
        toHexChars(val, c, 0, size);
        return new String(c);
    }

    /**

     * 3 - disconnecting
     */
    int connectionState;
    int tid;

    String share;
    String service = "?????";
    String service0;
    SmbSession session;
    boolean inDfs, inDomainDfs;
    int tree_num; // used by SmbFile.isOpen

    SmbTree(final SmbSession session, final String share, final String service) {
        this.session = session;
        this.share = share.toUpperCase();

public class ContentNotFoundExceptionTest extends UnitFessTestCase {

    public void test_constructor_withValidUrls() {
        // Test with normal URLs
        String parentUrl = "http://example.com/parent";
        String url = "http://example.com/child";
        ContentNotFoundException exception = new ContentNotFoundException(parentUrl, url);

        assertNotNull(exception);

    # Return some error
    ...
```

But by using the `secrets.compare_digest()` it will be secure against a type of attacks called "timing attacks".

### Timing Attacks { #timing-attacks }

But what's a "timing attack"?

Let's imagine some attackers are trying to guess the username and password.

And they send a request with a username `johndoe` and a password `love123`.

        CIFSException last = null;
        final RequestWithPath rpath = request instanceof RequestWithPath r ? r : null;
        final String savedPath = rpath != null ? rpath.getPath() : null;
        final String savedFullPath = rpath != null ? rpath.getFullUNCPath() : null;

        final String fullPath = "\\" + loc.getServer() + "\\" + loc.getShare() + loc.getUNCPath();
        final int maxRetries = this.ctx.getConfig().getMaxRequestRetries();

{* ../../docs_src/path_params_numeric_validations/tutorial006_an_py39.py hl[13] *}

## Recap { #recap }

With `Query`, `Path` (and others you haven't seen yet) you can declare metadata and string validations in the same ways as with [Query Parameters and String Validations](query-params-str-validations.md){.internal-link target=_blank}.

And you can also declare numeric validations:

* `gt`: `g`reater `t`han
* `ge`: `g`reater than or `e`qual

    class Local<T> {}
    TypeToken<Local<String>> type = new TypeToken<Local<String>>() {};
    assertEquals(Types.newParameterizedType(Local.class, String.class), type.getType());
    assertEquals(new Local<String>() {}.getClass().getGenericSuperclass(), type.getType());
  }

  public void testGenericArrayType() {
    TypeToken<List<String>[]> token = new TypeToken<List<String>[]>() {};