PasswordUsedDirectlyAsEncryptionKey

warning native off by default

Group: Security

Encryption APIs do not derive a cryptographic key from a password. Apply an appropriate key derivation function before encrypting or decrypting. This inspection is disabled by default because the intended policy or use can vary.

Example

<?php
openssl_encrypt($data,"aes-256-gcm",$_POST["password"],OPENSSL_RAW_DATA,$iv,$tag);

Reported:

• line 2: Derive an encryption key from the password.

Detection

• Resolved openssl_encrypt/decrypt key argument directly references request data from a configurable password key list, default [password, passphrase]. Require request-origin expression and explicit configured key; generic request fields are excluded. KDF output is not direct password data.
• Source provenance additionally requires an untouched lexical superglobal prefix. Exclude earlier explicit writes to or reference escapes of that superglobal and any earlier write or reference target involving GLOBALS. Reject all earlier object construction and unknown calls, including calls with no arguments, method calls and static calls; only resolved strlen, is_string, ctype_alnum, ctype_digit or in_array are supported pure-call exceptions. Traverse at most 4096 AST nodes, excluding nested variable scopes; exhaustion or unsupported source mutation discards the request-origin proof.
• Resolve builtin functions, classes, constants and methods; user-defined lookalikes are excluded. Follow only bounded local proof in one lexical scope.
• Emit one finding per violating operation, not per supporting evidence statement. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Do not report unresolved or shadowed builtin names, unknown values, or incomplete receiver/type provenance. Unknown calls, aliases escaping, and intervening writes invalidate local proof. Similar code outside the stated detection contract is not a finding.
• Both standard suppression forms suppress this native ID.

Fix

None. Choosing a repair requires intent or additional runtime information.

PHP versions

Available throughout supported PHP 5.3–8.5 where the referenced builtin/extension is available. Respect syntax/version-specific receiver contracts; unavailable APIs are not this rule’s concern.

Options

Option	Type	Default	Effect
passwordKeys	list	["password", "passphrase"]	Request fields that hold passwords; only these are checked when used as an encryption key.

Configure

In custos.json:

{
  "rules": {
    "PasswordUsedDirectlyAsEncryptionKey": {
      "enabled": true,
      "options": {
        "passwordKeys": ["password","passphrase"]
      }
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore PasswordUsedDirectlyAsEncryptionKey