{"record":{"id":"46f3818750ba104a","repo":"ratchetphp/Ratchet","slug":"invalid-port","errorCode":null,"errorMessage":"Invalid Port","messagePattern":"Invalid Port","errorType":"validation","errorClass":"UnexpectedValueException","httpStatus":null,"severity":"error","filePath":"src/Ratchet/Server/FlashPolicy.php","lineNumber":66,"sourceCode":"     * @param string $domain Specifies a requesting domain to be granted access. Both named domains and IP\n     * addresses are acceptable values. Subdomains are considered different domains. A wildcard (*) can\n     * be used to match all domains when used alone, or multiple domains (subdomains) when used as a\n     * prefix for an explicit, second-level domain name separated with a dot (.)\n     * @param string $ports A comma-separated list of ports or range of ports that a socket connection\n     * is allowed to connect to. A range of ports is specified through a dash (-) between two port numbers.\n     * Ranges can be used with individual ports when separated with a comma. A single wildcard (*) can\n     * be used to allow all ports.\n     * @param bool $secure\n     * @throws \\UnexpectedValueException\n     * @return FlashPolicy\n     */\n    public function addAllowedAccess($domain, $ports = '*', $secure = false) {\n        if (!$this->validateDomain($domain)) {\n           throw new \\UnexpectedValueException('Invalid domain');\n        }\n\n        if (!$this->validatePorts($ports)) {\n           throw new \\UnexpectedValueException('Invalid Port');\n        }\n\n        $this->_access[]   = array($domain, $ports, (bool)$secure);\n        $this->_cacheValid = false;\n\n        return $this;\n    }\n    \n    /**\n     * Removes all domains from the allowed access list.\n     * \n     * @return \\Ratchet\\Server\\FlashPolicy\n     */\n    public function clearAllowedAccess() {\n        $this->_access      = array();\n        $this->_cacheValid = false;\n\n        return $this;","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/ratchetphp/Ratchet/blob/e621c6c40bf684bbbb877102416ad5303d05a9cc/src/Ratchet/Server/FlashPolicy.php#L48-L84","documentation":"FlashPolicy::addAllowedAccess() validates the $ports value via validatePorts() after the domain check. An invalid port spec throws UnexpectedValueException('Invalid Port'). Valid values are '*' (any port), a single numeric port like '843', or a comma-separated list such as '80,443'; anything else (ranges like '1-1024', negative numbers, non-numeric text, empty strings) is rejected because Flash cross-domain policies only support enumerated ports or a blanket wildcard.","triggerScenarios":"Passing a port range ('1024-2048') instead of a comma list; passing an integer 0 or a negative number; passing '843,secure' or other non-numeric tokens; passing an empty string instead of '*' when intending all ports.","commonSituations":"Expressing firewall-style ranges in the policy config because that is how ops teams think about ports; confusing the policy port list with allowed scheme ports; leaving the config value blank expecting the default to behave like '*'.","solutions":["Use '*' for all ports, or enumerate them as a comma-separated list of plain numbers, e.g. '80,443,843'.","Convert any range from config into explicit ports before calling addAllowedAccess (expand '5000-5002' to '5000,5001,5002').","Cast strictly numeric values to string and trim whitespace so stray spaces or type juggling do not fail validation.","Remember Flash policy files only ever grant access on the policy port (843) or explicitly listed ports; drop ports you cannot serve."],"exampleFix":"// before\n$fp->addAllowedAccess('example.com', '1000-2000');\n\n// after\n$fp->addAllowedAccess('example.com', '1000,1001,1002'); // or '*' for all","handlingStrategy":"validation","validationCode":"function isValidFlashPolicyPorts($ports): bool {\n    if ($ports === '*') return true;\n    return (bool) preg_match('/^\\d+(,\\d+)*$/', (string) $ports);\n}\nif (!isValidFlashPolicyPorts($ports)) { /* normalize or reject before calling addAllowedAccess */ }","typeGuard":"function isFlashPortSpec($ports): bool {\n    return $ports === '*' || (is_string($ports) && preg_match('/^\\d+(,\\d+)*$/', $ports) === 1);\n}","tryCatchPattern":"try {\n    $fp->addAllowedAccess($domain, $ports);\n} catch (\\UnexpectedValueException $e) {\n    if ($e->getMessage() === 'Invalid Port') {\n        error_log(\"Rejecting invalid policy port spec: \" . var_export($ports, true));\n    } else { throw $e; }\n}","preventionTips":["Use only '*' or comma-separated numeric ports; never ranges.","Expand any configured range to an explicit comma list before calling the library.","Cast ports to string and trim whitespace at the config boundary.","Check the rendered policy output with a test so port mistakes are caught in CI."],"tags":["php","ratchet","flash-policy","validation"],"backgroundTag":"value-out-of-range","analyzedSha":"e621c6c40bf684bbbb877102416ad5303d05a9cc","analyzedAt":"2026-09-16T00:13:27.878Z","contentChangedAt":"2026-09-16T00:13:27.878Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}