{"record":{"id":"2215174b26e64820","repo":"ruby/ruby","slug":"unsupported-padding-mode","errorCode":null,"errorMessage":"unsupported padding mode","messagePattern":"unsupported padding mode","errorType":"exception","errorClass":"OpenSSL::PKey::PKeyError","httpStatus":null,"severity":"error","filePath":"ext/openssl/lib/openssl/pkey.rb","lineNumber":489,"sourceCode":"    end\n\n    PKCS1_PADDING = 1\n    SSLV23_PADDING = 2\n    NO_PADDING = 3\n    PKCS1_OAEP_PADDING = 4\n\n    private def translate_padding_mode(num)\n      case num\n      when PKCS1_PADDING\n        \"pkcs1\"\n      when SSLV23_PADDING\n        \"sslv23\"\n      when NO_PADDING\n        \"none\"\n      when PKCS1_OAEP_PADDING\n        \"oaep\"\n      else\n        raise PKeyError, \"unsupported padding mode\"\n      end\n    end\n  end\nend\n","sourceCodeStart":471,"sourceCodeEnd":494,"githubUrl":"https://github.com/ruby/ruby/blob/0e5b888e1c355f3f728f2659f085820937dada48/ext/openssl/lib/openssl/pkey.rb#L471-L494","documentation":"The private helper translate_padding_mode, shared by the four legacy RSA wrappers, maps the numeric padding constants (PKCS1_PADDING=1, SSLV23_PADDING=2, NO_PADDING=3, PKCS1_OAEP_PADDING=4) onto the string form the modern API accepts. Any other integer (or nil) falls through to else and raises PKeyError 'unsupported padding mode'. The error therefore always comes from the argument the caller passed.","triggerScenarios":"Passing a padding value outside 1..4 to private_encrypt, public_decrypt, public_encrypt or private_decrypt, for example a constant borrowed from another library, a raw integer from config, or nil after a broken default.","commonSituations":"Copy-pasted padding constants from a different binding; config files storing padding as a string ('oaep') that gets passed through unconverted; constants removed during a refactor leaving nil or 0 in place.","solutions":["Always pass constants from OpenSSL::PKey::RSA: PKCS1_PADDING, SSLV23_PADDING, NO_PADDING, PKCS1_OAEP_PADDING.","Validate the padding argument against that set before calling the legacy methods.","Migrate to rsa.encrypt/decrypt/sign_raw/verify_recover with an options hash such as { 'rsa_padding_mode' => 'oaep' }."],"exampleFix":"# before\nrsa.public_encrypt(data, 9) # not a defined constant\n\n# after\nrsa.public_encrypt(data, OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING)\n# or the modern form:\nrsa.encrypt(data, { 'rsa_padding_mode' => 'oaep' })","handlingStrategy":"validation","validationCode":"VALID_PADDING = [\n  OpenSSL::PKey::RSA::PKCS1_PADDING,\n  OpenSSL::PKey::RSA::SSLV23_PADDING,\n  OpenSSL::PKey::RSA::NO_PADDING,\n  OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING\n].freeze\nraise ArgumentError, 'unsupported padding' unless VALID_PADDING.include?(padding)\nrsa.public_encrypt(data, padding)","typeGuard":"def rsa_padding?(num)\n  [OpenSSL::PKey::RSA::PKCS1_PADDING,\n   OpenSSL::PKey::RSA::SSLV23_PADDING,\n   OpenSSL::PKey::RSA::NO_PADDING,\n   OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING].include?(num)\nend","tryCatchPattern":"begin\n  rsa.public_encrypt(data, padding)\nrescue OpenSSL::PKey::PKeyError => e\n  raise \"bad padding #{padding.inspect}: #{e.message}\"\nend","preventionTips":["Always pass OpenSSL::PKey::RSA padding constants.","Validate padding values coming from configuration before use.","Move to the modern options-hash API ('rsa_padding_mode' => 'oaep')."],"tags":["openssl","ruby","rsa","padding","configuration"],"backgroundTag":"invalid-padding-mode","analyzedSha":"0e5b888e1c355f3f728f2659f085820937dada48","analyzedAt":"2026-08-21T14:25:43.473Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}