SodiumSecretboxNonceReused

warning native on by default PHP ≥ 7.2

Group: Security

Identify the second secretbox encryption on same proven key and nonce when plaintexts are proven distinct. Identical plaintexts, unknown equality, new nonce and new key exclude.

Detection

• Report the second secretbox encryption on same proven key and nonce when plaintexts are proven distinct. Identical plaintexts, unknown equality, new nonce and new key exclude.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values, escaped aliases or exhausted analysis budgets invalidate proof.
• A write to the nonce or key variable between the two encryptions ends the proof, whatever its form: plain or compound assignment, a [...]/list(...) destructuring slot, a foreach key or value variable, an offset write such as $nonce[0] = ..., ++/--, a reference alias, an argument bound to a by-reference parameter of a resolved callee, extract()/parse_str(), or an assignment through a variable variable. Only an earlier encryption located after the latest such write, with the same nonce and key expressions and a different known plaintext, can still justify a report.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• Both @custos-ignore SodiumSecretboxNonceReused and @noinspection SodiumSecretboxNonceReused suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Requires PHP 7.2 or later. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "SodiumSecretboxNonceReused": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore SodiumSecretboxNonceReused