{"record":{"id":"abda595b1e5d1bc9","repo":"gchq/CyberChef","slug":"unknown-padding-type-padding-abda59","errorCode":null,"errorMessage":"Unknown padding type: ${padding}","messagePattern":"Unknown padding type: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/TEA.mjs","lineNumber":213,"sourceCode":"        case \"NO\":\n            throw new OperationError(\n                `No padding requested but input length (${message.length} bytes) is not a multiple of ${BLOCK_SIZE} bytes.`\n            );\n        case \"PKCS5\":\n            for (let i = 0; i < nPadding; i++) padded.push(nPadding);\n            break;\n        case \"ZERO\":\n            for (let i = 0; i < nPadding; i++) padded.push(0);\n            break;\n        case \"RANDOM\":\n            for (let i = 0; i < nPadding; i++) padded.push(Math.floor(Math.random() * 256));\n            break;\n        case \"BIT\":\n            padded.push(0x80);\n            for (let i = 1; i < nPadding; i++) padded.push(0);\n            break;\n        default:\n            throw new OperationError(`Unknown padding type: ${padding}`);\n    }\n\n    return padded;\n}\n\n/**\n * Remove padding from message\n * @param {number[]} message\n * @param {string} padding\n * @returns {number[]}\n */\nfunction removePadding(message, padding) {\n    if (message.length === 0) return message;\n\n    switch (padding) {\n        case \"NO\":\n        case \"ZERO\":\n        case \"RANDOM\":","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/TEA.mjs#L195-L231","documentation":"Default branch of applyPadding's switch in TEA.mjs:214. Any padding value other than {NO, PKCS5, ZERO, RANDOM, BIT} reaches this throw, reporting the unrecognised value.","triggerScenarios":"Encrypt path called with padding not in the supported set. Examples: 'PKCS7' (not a recognised literal here — use 'PKCS5'), 'ANSIX923', lowercase 'pkcs5', an empty string, or undefined.","commonSituations":"Padding string sourced from user input or a recipe without normalisation; downstream code uses a different enum name than the library; refactor renamed the enum on one side only.","solutions":["Pass one of: 'NO', 'PKCS5', 'ZERO', 'RANDOM', 'BIT'.","Normalise (trim + uppercase) and validate against an allowlist before encrypting.","For PKCS#7-style padding use the literal 'PKCS5'."],"exampleFix":"// before\nencryptWithBlockMode(msg, key, iv, \"CBC\", \"PKCS7\");\n// after\nencryptWithBlockMode(msg, key, iv, \"CBC\", \"PKCS5\");","handlingStrategy":"validation","validationCode":"const TEA_PADDING = new Set([\"NO\", \"PKCS5\", \"ZERO\", \"RANDOM\", \"BIT\"]);\nfunction normaliseTeaPadding(p) {\n  const v = String(p).trim().toUpperCase();\n  if (!TEA_PADDING.has(v)) throw new TypeError(`Unsupported TEA padding: ${JSON.stringify(p)}`);\n  return v;\n}","typeGuard":"function isTeaPadding(v) {\n  return typeof v === \"string\" &&\n    [\"NO\",\"PKCS5\",\"ZERO\",\"RANDOM\",\"BIT\"].includes(v.trim().toUpperCase());\n}","tryCatchPattern":"try {\n  encryptWithBlockMode(msg, key, iv, mode, normaliseTeaPadding(padding));\n} catch (e) {\n  if (e instanceof TypeError && /Unsupported TEA padding/.test(e.message)) {\n    // report unsupported padding\n  } else throw e;\n}","preventionTips":["Normalise padding literals (trim + uppercase) at the trust boundary.","Use the literal 'PKCS5' for PKCS#7-style padding (the library does not accept 'PKCS7').","Share one padding allowlist across encrypt and decrypt."],"tags":["tea","xtea","cipher","padding","enum","argument-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}