{"record":{"id":"a0984b8dd8514335","repo":"git-ecosystem/git-credential-manager","slug":"unknown-pkce-code-challenge-method","errorCode":null,"errorMessage":"Unknown PKCE code challenge method.","messagePattern":"Unknown PKCE code challenge method\\.","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/Core/Authentication/OAuth/OAuth2CryptographicGenerator.cs","lineNumber":98,"sourceCode":"                case OAuth2PkceChallengeMethod.Plain:\n                    return codeVerifier;\n\n                case OAuth2PkceChallengeMethod.Sha256:\n                    // The \"S256\" code challenge is computed as follows, per RFC 7636:\n                    //\n                    //   code_challenge = BASE64URL-ENCODE(SHA256(ASCII(code_verifier)))\n                    //\n                    using (var sha256 = SHA256.Create())\n                    {\n                        return Base64Url.EncodeToString(\n                            sha256.ComputeHash(\n                                Encoding.ASCII.GetBytes(codeVerifier)\n                            )\n                        );\n                    }\n\n                default:\n                    throw new ArgumentOutOfRangeException(nameof(challengeMethod), challengeMethod, \"Unknown PKCE code challenge method.\");\n            }\n        }\n    }\n}\n","sourceCodeStart":80,"sourceCodeEnd":103,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Authentication/OAuth/OAuth2CryptographicGenerator.cs#L80-L103","documentation":"The OAuth2CryptographicGenerator throws ArgumentOutOfRangeException when asked to create a PKCE code challenge with a code_challenge_method it does not implement. The switch over the challenge method enum has no handler for the given value, so generation cannot proceed safely and the library refuses rather than producing a non-compliant challenge.","triggerScenarios":"Calling CreatePkceCodeChallenge (directly or via the challenge/actualChallenge code paths) with a PKCEChallengeMethod value outside the supported set (e.g. an undefined enum cast, or a method parsed from an unexpected 'code_challenge_method' wire value).","commonSituations":"Constructing the enum from an int or string without validation; a library upgrade adding a new PKCE method that a caller forwards before the generator supports it; tests probing enum boundaries.","solutions":["Use only the supported PKCE methods, typically S256 (and 'plain' if supported by this build)","Validate the challengeMethod value before calling CreatePkceCodeChallenge","If parsing the method from config/wire input, reject unknown values early with a clear error","Update the library if you need a newer PKCE method that the current generator lacks"],"exampleFix":"// before\nvar challenge = generator.CreatePkceCodeChallenge((PKCEChallengeMethod)5, verifier);\n// after\nvar method = PKCEChallengeMethod.S256; // supported value\nvar challenge = generator.CreatePkceCodeChallenge(method, verifier);","handlingStrategy":"validation","validationCode":"if (!Enum.IsDefined(typeof(PKCEChallengeMethod), challengeMethod)) throw new ArgumentException($\"Unsupported PKCE method: {challengeMethod}\", nameof(challengeMethod));","typeGuard":"bool IsSupportedPkceMethod(PKCEChallengeMethod m) => m == PKCEChallengeMethod.S256;","tryCatchPattern":"try { challenge = generator.CreatePkceCodeChallenge(method, verifier); } catch (ArgumentOutOfRangeException) { challenge = generator.CreatePkceCodeChallenge(PKCEChallengeMethod.S256, verifier); }","preventionTips":["Only use enum members the generator documents as supported (S256)","Never cast ints/strings to the method enum without Enum.IsDefined/TryParse","Add unit tests covering every enum member passed to CreatePkceCodeChallenge"],"tags":["oauth2","pkce","argumentoutofrange","enum"],"backgroundTag":"invalid-enum-value","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}