{"record":{"id":"805b92bba3375c8e","repo":"ratchetphp/Ratchet","slug":"invalid-domain","errorCode":null,"errorMessage":"Invalid domain","messagePattern":"Invalid domain","errorType":"validation","errorClass":"UnexpectedValueException","httpStatus":null,"severity":"error","filePath":"src/Ratchet/Server/FlashPolicy.php","lineNumber":62,"sourceCode":"\n    /**\n     * Add a domain to an allowed access list.\n     *\n     * @param string $domain Specifies a requesting domain to be granted access. Both named domains and IP\n     * addresses are acceptable values. Subdomains are considered different domains. A wildcard (*) can\n     * be used to match all domains when used alone, or multiple domains (subdomains) when used as a\n     * prefix for an explicit, second-level domain name separated with a dot (.)\n     * @param string $ports A comma-separated list of ports or range of ports that a socket connection\n     * is allowed to connect to. A range of ports is specified through a dash (-) between two port numbers.\n     * Ranges can be used with individual ports when separated with a comma. A single wildcard (*) can\n     * be used to allow all ports.\n     * @param bool $secure\n     * @throws \\UnexpectedValueException\n     * @return FlashPolicy\n     */\n    public function addAllowedAccess($domain, $ports = '*', $secure = false) {\n        if (!$this->validateDomain($domain)) {\n           throw new \\UnexpectedValueException('Invalid domain');\n        }\n\n        if (!$this->validatePorts($ports)) {\n           throw new \\UnexpectedValueException('Invalid Port');\n        }\n\n        $this->_access[]   = array($domain, $ports, (bool)$secure);\n        $this->_cacheValid = false;\n\n        return $this;\n    }\n    \n    /**\n     * Removes all domains from the allowed access list.\n     * \n     * @return \\Ratchet\\Server\\FlashPolicy\n     */\n    public function clearAllowedAccess() {","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/ratchetphp/Ratchet/blob/e621c6c40bf684bbbb877102416ad5303d05a9cc/src/Ratchet/Server/FlashPolicy.php#L44-L80","documentation":"FlashPolicy::addAllowedAccess() validates each domain string before adding it to the cross-domain policy it will render. When validateDomain() rejects the value it throws UnexpectedValueException('Invalid domain'). The validator only accepts domains matching a safe pattern (letters, digits, hyphens, dots, and '*' wildcards such as '*.example.com' or '*'), so URLs, ports embedded in the domain, protocols, or malformed wildcards are rejected.","triggerScenarios":"Passing a URL like 'http://example.com' or 'example.com:8080' as $domain (scheme/port must go elsewhere); passing 'sub.*.example.com' or a bare '*' in an invalid position; passing an empty string or a value with spaces, underscores, or other characters outside the validator's pattern.","commonSituations":"Copy-pasting an origin URL from a browser instead of the bare hostname; trying to open a specific port by appending ':port' to the domain instead of using the $ports parameter; building the domain string dynamically from config where an empty or placeholder value slips through.","solutions":["Pass only the bare hostname or wildcard pattern, e.g. 'example.com', '*.example.com', or '*', and move port configuration to the $ports argument.","Strip scheme and port before calling: parse the configured origin (parse_url) and pass only $parts['host'].","Validate the domain against the same shape in your own config layer (alphanumerics, hyphens, dots, leading '*.') so bad config fails early with a clearer message.","If access for arbitrary subdomains is needed, use '*.example.com' rather than inserting a wildcard mid-domain, which is not accepted."],"exampleFix":"// before\n$fp->addAllowedAccess('http://cdn.example.com:8443');\n\n// after\n$fp->addAllowedAccess('cdn.example.com', '8443');","handlingStrategy":"validation","validationCode":"function isValidFlashPolicyDomain(string $domain): bool {\n    return (bool) preg_match('/^(\\*|(\\*\\.)?([a-z0-9-]+\\.)+[a-z0-9-]+)$/i', $domain);\n}\n$host = parse_url($origin, PHP_URL_HOST) ?? $origin;\nif (!isValidFlashPolicyDomain($host)) { /* reject config before calling the library */ }","typeGuard":"function isFlashDomain($domain): bool {\n    return is_string($domain) && preg_match('/^(\\*|(\\*\\.)?([a-z0-9-]+\\.)+[a-z0-9-]+)$/i', $domain) === 1;\n}","tryCatchPattern":"try {\n    $fp->addAllowedAccess($domain, $ports);\n} catch (\\UnexpectedValueException $e) {\n    if ($e->getMessage() === 'Invalid domain') {\n        error_log(\"Rejecting invalid policy domain: {$domain}\");\n    } else { throw $e; }\n}","preventionTips":["Store bare hostnames (no scheme, no port) in config for policy domains.","Validate domains with a small regex whitelist before calling the library.","Use '*.example.com' for subdomain wildcards, never mid-domain wildcards.","Log the offending domain value at the call site so bad config is identifiable."],"tags":["php","ratchet","flash-policy","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"e621c6c40bf684bbbb877102416ad5303d05a9cc","analyzedAt":"2026-09-16T00:13:27.878Z","contentChangedAt":"2026-09-16T00:13:27.878Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}