{"record":{"id":"163e95330f7f5dca","repo":"yiisoft/yii2","slug":"first-parameter-length-must-be-greater-than-0","errorCode":null,"errorMessage":"First parameter ($length) must be greater than 0","messagePattern":"First parameter \\(\\$length\\) must be greater than 0","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"framework/base/Security.php","lineNumber":412,"sourceCode":"\n    /**\n     * Generates specified number of random bytes.\n     * Note that output may not be ASCII.\n     * @see generateRandomString() if you need a string.\n     *\n     * @param int $length the number of bytes to generate\n     * @return string the generated random bytes\n     * @throws InvalidArgumentException if wrong length is specified\n     * @throws Exception on failure.\n     */\n    public function generateRandomKey($length = 32)\n    {\n        if (!is_int($length)) {\n            throw new InvalidArgumentException('First parameter ($length) must be an integer');\n        }\n\n        if ($length < 1) {\n            throw new InvalidArgumentException('First parameter ($length) must be greater than 0');\n        }\n\n        return random_bytes($length);\n    }\n\n    /**\n     * Generates a random string of specified length.\n     * The string generated matches [A-Za-z0-9_-]+ and is transparent to URL-encoding.\n     *\n     * @param int $length the length of the key in characters\n     * @return string the generated random key\n     * @throws Exception on failure.\n     */\n    public function generateRandomString($length = 32)\n    {\n        if (!is_int($length)) {\n            throw new InvalidArgumentException('First parameter ($length) must be an integer');\n        }","sourceCodeStart":394,"sourceCodeEnd":430,"githubUrl":"https://github.com/yiisoft/yii2/blob/66f00d18a29b520f85e8e8f1e32d1e7e7b556cac/framework/base/Security.php#L394-L430","documentation":"generateRandomKey() requires $length >= 1 so random_bytes() is never invoked with a zero or negative count. Reaching this exception means an integer 0 or negative value was passed — typically a computed size that legitimately evaluated to 0 (empty input, block-aligned data) rather than a typo.","triggerScenarios":"Padding computed as $blockSize - (strlen($data) % $blockSize) hitting 0 for block-aligned data; generateRandomKey(count($items)) with an empty collection; subtraction with swapped operands yielding a negative; config values defaulting to 0.","commonSituations":"Cryptographic padding/salt code paths that only fail for certain input lengths; optional inputs where an empty selection produces length 0; off-by-one or operand-order arithmetic bugs.","solutions":["Guard computed sizes: max(1, $computed) when at least one byte is acceptable, or skip the call entirely when 0 is the correct answer","Fix operand order in size arithmetic ($total - $used vs $used - $total)","Validate config-driven sizes as >= 1 at bootstrap","Cover the edge lengths (0, 1, boundary) in unit tests for code that computes sizes"],"exampleFix":"// before\n$padding = $blockSize - (strlen($data) % $blockSize);\n$salt = Yii::$app->security->generateRandomKey($padding); // 0 when data is block-aligned → exception\n\n// after\n$padding = $blockSize - (strlen($data) % $blockSize);\n$salt = $padding >= 1 ? Yii::$app->security->generateRandomKey($padding) : '';","handlingStrategy":"validation","validationCode":"$length = (int) $computed;\nif ($length < 1) {\n    throw new \\InvalidArgumentException('Computed random key length must be >= 1, got ' . $computed);\n}\n$bytes = Yii::$app->security->generateRandomKey($length);","typeGuard":"function isPositiveIntLength($length): bool\n{\n    return is_int($length) && $length >= 1;\n}","tryCatchPattern":null,"preventionTips":["Treat a computed length of 0 as a no-op and skip the call rather than passing it down","Unit-test boundary lengths (0, 1, block size) in code that derives sizes arithmetically","Reject zero/negative lengths with input validation before they reach Security"],"tags":["php","yii2","security","random","argument-validation"],"backgroundTag":"zero-or-negative-length","analyzedSha":"66f00d18a29b520f85e8e8f1e32d1e7e7b556cac","analyzedAt":"2026-08-17T05:17:23.470Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}