SodiumSecretboxKeyLengthMismatch

error native on by default PHP ≥ 7.2

Group: Security

Identify sodium_crypto_secretbox or open when key byte length is proven other than SODIUM_CRYPTO_SECRETBOX_KEYBYTES; unknown length excludes.

Detection

• Report sodium_crypto_secretbox or open when key byte length is proven other than SODIUM_CRYPTO_SECRETBOX_KEYBYTES; unknown length excludes.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values, escaped aliases or exhausted analysis budgets invalidate proof.
• D4. A key held in a local variable keeps its proven length only while plain assignments are the sole writes before the call. Any earlier indirect write in the same scope makes the length unknown: a reference taken to the variable ($r = &$k, [&$k], legacy call-time &$k), the variable as a list()/[...] destructuring target or foreach key/value target, a closure importing it with use (&$k), a global import, the variable passed directly to a method, constructor, unresolved function or a builtin that declares a by-reference parameter, an extract() call, or any variable variable.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• Both @custos-ignore SodiumSecretboxKeyLengthMismatch and @noinspection SodiumSecretboxKeyLengthMismatch suppress this native rule.
• Indirect writes listed in D4 that occur before the call suppress the finding; the same constructs after the call, plain reads, by-value closure imports and arrow functions do not.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Requires PHP 7.2 or later. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "SodiumSecretboxKeyLengthMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SodiumSecretboxKeyLengthMismatch