{"record":{"id":"aec3f0518b3a1675","repo":"ratchetphp/Ratchet","slug":"invalid-site-control-set","errorCode":null,"errorMessage":"Invalid site control set","messagePattern":"Invalid site control set","errorType":"validation","errorClass":"UnexpectedValueException","httpStatus":null,"severity":"error","filePath":"src/Ratchet/Server/FlashPolicy.php","lineNumber":98,"sourceCode":"    public function clearAllowedAccess() {\n        $this->_access      = array();\n        $this->_cacheValid = false;\n\n        return $this;\n    }\n\n    /**\n     * site-control defines the meta-policy for the current domain. A meta-policy specifies acceptable\n     * domain policy files other than the master policy file located in the target domain's root and named\n     * crossdomain.xml.\n     *\n     * @param string $permittedCrossDomainPolicies\n     * @throws \\UnexpectedValueException\n     * @return FlashPolicy\n     */\n    public function setSiteControl($permittedCrossDomainPolicies = 'all') {\n        if (!$this->validateSiteControl($permittedCrossDomainPolicies)) {\n            throw new \\UnexpectedValueException('Invalid site control set');\n        }\n\n        $this->_siteControl = $permittedCrossDomainPolicies;\n        $this->_cacheValid  = false;\n\n        return $this;\n    }\n\n    /**\n     * {@inheritdoc}\n     */\n    public function onOpen(ConnectionInterface $conn) {\n    }\n\n    /**\n     * {@inheritdoc}\n     */\n    public function onMessage(ConnectionInterface $from, $msg) {","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/ratchetphp/Ratchet/blob/e621c6c40bf684bbbb877102416ad5303d05a9cc/src/Ratchet/Server/FlashPolicy.php#L80-L116","documentation":"FlashPolicy::setSiteControl() defines the <site-control permitted-cross-domain-policies=\"...\"/> directive of the generated policy document. It validates the value via validateSiteControl() and throws UnexpectedValueException('Invalid site control set') for anything outside the Flash spec's accepted values. Only a fixed set of directives is legal: 'all', 'none', 'master-only', 'by-content-type', and 'by-ftp-filename'.","triggerScenarios":"Passing an arbitrary string like 'always', 'true', 'allow', or a custom policy name; leaving a config value blank or misspelling one of the five valid directives (e.g. 'Master-Only' with different casing if the validator is case-sensitive); calling setSiteControl with user-supplied input without whitelisting.","commonSituations":"Misunderstanding site-control as an allow-list (it is not; allowed domains go to addAllowedAccess); copying a meta-policy value from a different spec; config drift where the environment variable for the directive contains an unsupported option.","solutions":["Use one of the five spec-valid values: 'all', 'none', 'master-only', 'by-content-type', 'by-ftp-filename'.","If the intent is to restrict which domains may connect, do not change site-control — call addAllowedAccess() for each permitted domain instead.","Whitelist/normalize the value in your config layer (strtolower plus in_array check) before passing it to setSiteControl.","If unsure, omit setSiteControl; the default 'all' (permitted cross-domain policies everywhere) is applied by the constructor."],"exampleFix":"// before\n$fp->setSiteControl('allow-all');\n\n// after\n$fp->setSiteControl('all'); // or 'master-only', 'none', 'by-content-type', 'by-ftp-filename'","handlingStrategy":"validation","validationCode":"$allowed = ['all', 'none', 'master-only', 'by-content-type', 'by-ftp-filename'];\n$value = strtolower(trim($permittedCrossDomainPolicies));\nif (!in_array($value, $allowed, true)) {\n    throw new \\InvalidArgumentException(\"permitted-cross-domain-policies must be one of: \" . implode(', ', $allowed));\n}\n$fp->setSiteControl($value);","typeGuard":"function isValidSiteControl($v): bool {\n    return in_array($v, ['all','none','master-only','by-content-type','by-ftp-filename'], true);\n}","tryCatchPattern":"try {\n    $fp->setSiteControl($directive);\n} catch (\\UnexpectedValueException $e) {\n    if ($e->getMessage() === 'Invalid site control set') {\n        error_log(\"Invalid permitted-cross-domain-policies directive: {$directive}\");\n    } else { throw $e; }\n}","preventionTips":["Keep a whitelist constant of the five valid directives and validate config against it.","Remember site-control is a meta-policy, not a domain allow-list — use addAllowedAccess for domains.","Normalize case/whitespace from environment variables before passing the directive.","Prefer the default and omit setSiteControl unless you specifically need 'none' or 'master-only'."],"tags":["php","ratchet","flash-policy","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"e621c6c40bf684bbbb877102416ad5303d05a9cc","analyzedAt":"2026-09-16T00:13:27.878Z","contentChangedAt":"2026-09-16T00:13:27.878Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}