client-v2: drop blank tokens from ssl_cipher_suites before enabling them

A leading, trailing or doubled comma in ssl_cipher_suites (or a raw List
option) leaves an empty or whitespace-only token in the parsed list. The
value was only checked for emptiness (zero elements), so a blank token
reached SSLSocket#setEnabledCipherSuites, which throws IllegalArgumentException
("invalid null or empty string elements") and breaks the TLS handshake even
when valid suites are also present. Blank tokens are now dropped and each
surviving name is trimmed; a list that reduces to nothing is treated as
"no restriction" (JVM defaults), matching the empty/unset behaviour.

Addresses the Cursor Bugbot review comment on PR #2919.

Author: polyglotAI-bot

client-v2/src/main/java/com/clickhouse/client/api/internal/HttpAPIClientHelper.java

@@ -290,8 +290,17 @@ public CloseableHttpClient createHttpClient(boolean initSslContext, Map<String,
             boolean trustAllHostnames = sslMode == SSLMode.TRUST || sslMode == SSLMode.VERIFY_CA;
             boolean hasSNI = socketSNI != null && !socketSNI.trim().isEmpty();
             List<String> cipherSuites = ClientConfigProperties.SSL_CIPHER_SUITES.getOrDefault(configuration);
-            String[] enabledCipherSuites = cipherSuites == null || cipherSuites.isEmpty()
-                    ? null : cipherSuites.toArray(new String[0]);
+            // Drop blank tokens (e.g. from a leading, trailing or doubled comma in ssl_cipher_suites) and trim
+            // each name: a null, empty or whitespace-only entry is rejected by the SSL socket and breaks the
+            // handshake even when valid suites are also present.
+            String[] enabledCipherSuites = cipherSuites == null ? null
+                    : cipherSuites.stream()
+                            .filter(s -> s != null && !s.trim().isEmpty())
+                            .map(String::trim)
+                            .toArray(String[]::new);
+            if (enabledCipherSuites != null && enabledCipherSuites.length == 0) {
+                enabledCipherSuites = null;
+            }
             if (hasSNI || trustAllHostnames || enabledCipherSuites != null) {
                 // Skip hostname verification only for trust-all modes or when a custom SNI is used (the
                 // connection hostname would not match the certificate); otherwise a null verifier makes the

client-v2/src/test/java/com/clickhouse/client/api/internal/HttpAPIClientHelperTest.java

@@ -221,6 +221,45 @@ public void testCreateHttpClientEmptyCipherSuitesTreatedAsNoRestriction() {
                 + "defaults), so the plain SSLConnectionSocketFactory is used");
     }
 
+    /**
+     * Malformed cipher-suite input - blank tokens from a leading, trailing or doubled comma, and
+     * whitespace-padded names - must be sanitized before reaching the SSL socket: a null, empty or
+     * whitespace-only entry is rejected by {@code SSLSocket#setEnabledCipherSuites} ("invalid null or empty
+     * string elements") and breaks the handshake even when valid suites are also present. The blanks must be
+     * dropped and the surviving names trimmed, preserving order.
+     */
+    @Test
+    public void testCreateHttpClientDropsBlankAndWhitespaceCipherTokens() {
+        Map<String, Object> config = new HashMap<>();
+        config.put(ClientConfigProperties.SSL_CIPHER_SUITES.getKey(),
+                Arrays.asList("", "TLS_AES_256_GCM_SHA384", "", "   ", " TLS_AES_128_GCM_SHA256 "));
+
+        List<List<?>> calls = captureCustomFactoryConstruction(config);
+
+        assertEquals(calls.size(), 1, "configured (non-blank) cipher suites must still build the custom factory");
+        List<?> args = calls.get(0);
+        assertEquals((String[]) args.get(3),
+                new String[]{"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256"},
+                "blank tokens (leading/doubled comma, whitespace-only) must be dropped and surviving names "
+                        + "trimmed before being forwarded to the SSL socket factory");
+    }
+
+    /**
+     * Boundary case: a cipher-suite list that contains only blank tokens (e.g. from a property that is just
+     * commas/whitespace) has no usable suite, so - like an empty or unset list - it must be treated as "no
+     * restriction" (JVM defaults) rather than forwarding an all-blank array that would fail every handshake.
+     */
+    @Test
+    public void testCreateHttpClientBlankOnlyCipherSuitesTreatedAsNoRestriction() {
+        Map<String, Object> config = new HashMap<>();
+        config.put(ClientConfigProperties.SSL_CIPHER_SUITES.getKey(), Arrays.asList("", "   "));
+
+        List<List<?>> calls = captureCustomFactoryConstruction(config);
+
+        assertEquals(calls.size(), 0, "a cipher-suite list of only blank tokens must be treated as no "
+                + "restriction (JVM defaults), so the plain SSLConnectionSocketFactory is used");
+    }
+
     /**
      * Builds an {@link HttpAPIClientHelper} and invokes {@link HttpAPIClientHelper#createHttpClient} with SSL
      * enabled while intercepting every {@link CustomSSLConnectionFactory} construction, returning the