{"record":{"id":"07c258b95b6fad5e","repo":"paragonie/random_compat","slug":"com-does-not-exist","errorCode":null,"errorMessage":"COM does not exist","messagePattern":"COM does not exist","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"lib/random_bytes_com_dotnet.php","lineNumber":61,"sourceCode":"        try {\n            /** @var int $bytes */\n            $bytes = RandomCompat_intval($bytes);\n        } catch (TypeError $ex) {\n            throw new TypeError(\n                'random_bytes(): $bytes must be an integer'\n            );\n        }\n\n        if ($bytes < 1) {\n            throw new Error(\n                'Length must be greater than 0'\n            );\n        }\n\n        /** @var string $buf */\n        $buf = '';\n        if (!class_exists('COM')) {\n            throw new Error(\n                'COM does not exist'\n            );\n        }\n        /** @var COM $util */\n        $util = new COM('CAPICOM.Utilities.1');\n        $execCount = 0;\n\n        /**\n         * Let's not let it loop forever. If we run N times and fail to\n         * get N bytes of random data, then CAPICOM has failed us.\n         */\n        do {\n            $buf .= base64_decode((string) $util->GetRandom($bytes, 0));\n            if (RandomCompat_strlen($buf) >= $bytes) {\n                /**\n                 * Return our random entropy buffer here:\n                 */\n                return (string) RandomCompat_substr($buf, 0, $bytes);","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/paragonie/random_compat/blob/b5d188cc9d5e02f94d2c41da23093f1ef557c5b1/lib/random_bytes_com_dotnet.php#L43-L79","documentation":"This codepath uses Windows CAPICOM's Utilities.GetRandom() through the COM extension as a CSPRNG source. If the COM class is not available (class_exists('COM') fails) the library cannot use this backend and throws immediately rather than silently producing weak randomness. On the com_dotnet build this is a hard environment requirement.","triggerScenarios":"Calling random_bytes() on a random_compat build where the COM backend was selected at load time, but the running PHP does not expose the COM class — i.e. PHP built without --enable-com-dotnet, the com_dotnet extension disabled in php.ini, or running on a non-Windows platform with this backend chosen.","commonSituations":"Deploying a Windows-targeted PHP build to Linux; php.ini missing 'extension=com_dotnet'; CLI vs web SAPI using different php.ini files where one lacks the extension; Docker images of PHP for Windows without the extension compiled in.","solutions":["Install/enable the COM dotnet extension: add extension=com_dotnet (or extension=php_com_dotnet.dll) to php.ini and restart PHP.","Verify with php -m or class_exists('COM') that COM is available in the same SAPI that runs the code.","Prefer upgrading PHP to >= 7.0 where native random_bytes() exists and random_compat is unnecessary.","Use a random_compat build/backing appropriate for the actual platform (e.g. mcrypt, openssl, /dev/urandom backends)."],"exampleFix":"// before (assumes COM exists)\n$bytes = random_bytes(32);\n// after\nif (!class_exists('COM')) {\n    throw new RuntimeException('random_bytes(): COM extension required; enable com_dotnet in php.ini');\n}\n$bytes = random_bytes(32);","handlingStrategy":"fallback","validationCode":"if (!class_exists('COM')) {\n    throw new RuntimeException('COM extension missing; cannot use CAPICOM CSPRNG backend');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $bytes = random_bytes(32);\n} catch (Error $e) {\n    if ($e->getMessage() === 'COM does not exist') {\n        // fall back to another CSPRNG source or fail securely\n        throw new RuntimeException('No CSPRNG available: enable com_dotnet or upgrade to PHP 7+', 0, $e);\n    }\n    throw $e;\n}","preventionTips":["Pin platform requirements: this backend is Windows + com_dotnet only.","Add extension=com_dotnet to php.ini for every SAPI (CLI, FPM) in deployment images.","Smoke-test random_bytes() in CI on the target platform/SAPI.","Upgrade to PHP >= 7.0 so native random_bytes() bypasses the COM backend entirely."],"tags":["php","environment","windows","com","missing-extension"],"backgroundTag":"missing-dependency","analyzedSha":"b5d188cc9d5e02f94d2c41da23093f1ef557c5b1","analyzedAt":"2026-09-13T16:12:09.755Z","contentChangedAt":"2026-09-13T16:12:09.755Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}