{"record":{"id":"084c51aec96bbe2f","repo":"gchq/CyberChef","slug":"invalid-block-cipher-mode-mode-084c51","errorCode":null,"errorMessage":"Invalid block cipher mode: ${mode}","messagePattern":"Invalid block cipher mode: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/SM4.mjs","lineNumber":232,"sourceCode":"                block[0] ^= iv[0]; block[1] ^= iv[1];\n                block[2] ^= iv[2]; block[3] ^= iv[3];\n                Array.prototype.push.apply(cipherText, intsToBytes(block));\n            }\n            break;\n        case \"CTR\":\n            iv = bytesToInts(iv, 0);\n            for (let i = 0; i < message.length; i += BLOCKSIZE) {\n                let iv2 = [...iv]; /* containing the IV + counter */\n                iv2[3] += (i >> 4);/* Using a 32 bit counter here. 64 Gb encrypts should be enough for everyone. */\n                iv2 = encryptBlockSM4(iv2, roundKey);\n                const block = bytesToInts(message, i);\n                block[0] ^= iv2[0]; block[1] ^= iv2[1];\n                block[2] ^= iv2[2]; block[3] ^= iv2[3];\n                Array.prototype.push.apply(cipherText, intsToBytes(block));\n            }\n            break;\n        default:\n            throw new OperationError(\"Invalid block cipher mode: \"+mode);\n    }\n    if (mode !== \"ECB\" && mode !== \"CBC\")\n        return cipherText.slice(0, messageLength);\n    return cipherText;\n}\n\n/**\n * Decrypt using SM4 using a given block cipher mode.\n *\n * @param {byteArray} cipherText - The ciphertext\n * @param {byteArray} key - The cipher key, 16 bytes.\n * @param {byteArray} iv - The IV or nonce, 16 bytes (not used with ECB mode)\n * @param {string} mode - The block cipher mode \"CBC\", \"ECB\", \"CFB\", \"OFB\", \"CTR\"\n * @param {boolean] ignorePadding - If true, ignore padding issues in ECB/CBC mode.\n * @returns {byteArray} - The cipher text.\n */\nexport function decryptSM4(cipherText, key, iv, mode=\"ECB\", ignorePadding=false) {\n    const originalLength = cipherText.length;","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/SM4.mjs#L214-L250","documentation":"Default branch of the mode switch inside encryptSM4 at SM4.mjs:232. The message uses string concatenation (\"...\"+mode) rather than a template literal. Any mode value outside {ECB, CBC, CFB, OFB, CTR} reaches this throw.","triggerScenarios":"encryptSM4 called with mode not in the supported set. Examples: lowercase 'cbc', 'GCM', an empty string, undefined, or a compound label like 'CBC/PKCS7'.","commonSituations":"Mode string from external config or UI passed without normalisation; case mismatch; assumption that an unsupported AEAD mode is available.","solutions":["Pass one of: 'ECB', 'CBC', 'CFB', 'OFB', 'CTR'.","Normalise the mode (trim + uppercase) and validate against an allowlist before calling encryptSM4."],"exampleFix":"// before\nconst ct = encryptSM4(msg, key, iv, \"cbc\");\n// after\nconst ct = encryptSM4(msg, key, iv, \"CBC\");","handlingStrategy":"validation","validationCode":"const SM4_MODES = new Set([\"ECB\", \"CBC\", \"CFB\", \"OFB\", \"CTR\"]);\nfunction normaliseSm4Mode(m) {\n  const v = String(m).trim().toUpperCase();\n  if (!SM4_MODES.has(v)) throw new TypeError(`Unsupported SM4 mode: ${JSON.stringify(m)}`);\n  return v;\n}","typeGuard":"function isSm4Mode(v) {\n  return typeof v === \"string\" &&\n    [\"ECB\",\"CBC\",\"CFB\",\"OFB\",\"CTR\"].includes(v.trim().toUpperCase());\n}","tryCatchPattern":"try {\n  encryptSM4(msg, key, iv, normaliseSm4Mode(mode));\n} catch (e) {\n  if (e instanceof TypeError && /Unsupported SM4 mode/.test(e.message)) {\n    // report unsupported mode\n  } else throw e;\n}","preventionTips":["Normalise the mode string at the trust boundary.","SM4 here supports no AEAD mode — do not assume GCM exists.","Reuse one mode allowlist across encrypt and decrypt."],"tags":["sm4","cipher","block-mode","enum","argument-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}