{"record":{"id":"b5f2eb33f8a5d788","repo":"infiniflow/ragflow","slug":"unsupported-algorithm-algorithm","errorCode":null,"errorMessage":"Unsupported algorithm: {algorithm}","messagePattern":"Unsupported algorithm: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"common/crypto_utils.py","lineNumber":256,"sourceCode":"\n\nclass CryptoUtil:\n    \"\"\"Cryptographic utility class, using factory pattern to create cryptographic algorithm instances\"\"\"\n\n    # Supported cryptographic algorithms mapping\n    SUPPORTED_ALGORITHMS = {\"aes-128-cbc\": AES128CBC, \"aes-256-cbc\": AES256CBC, \"sm4-cbc\": SM4CBC}\n\n    def __init__(self, algorithm=\"aes-256-cbc\", key=None, iv=None):\n        \"\"\"\n        Initialize cryptographic utility\n\n        Args:\n            algorithm: Cryptographic algorithm, default is aes-256-cbc\n            key: Encryption key, uses RAGFLOW_CRYPTO_KEY environment variable if None\n            iv: Initialization vector, automatically generated if None\n        \"\"\"\n        if algorithm not in self.SUPPORTED_ALGORITHMS:\n            raise ValueError(f\"Unsupported algorithm: {algorithm}\")\n\n        if not key:\n            raise ValueError(\"Encryption key not provided and RAGFLOW_CRYPTO_KEY environment variable not set\")\n\n        # Create cryptographic algorithm instance\n        self.algorithm_name = algorithm\n        self.crypto = self.SUPPORTED_ALGORITHMS[algorithm](key=key, iv=iv)\n\n    def encrypt(self, data):\n        \"\"\"\n        Encrypt data\n\n        Args:\n            data: Data to encrypt (bytes)\n\n        Returns:\n            Encrypted data (bytes)\n        \"\"\"","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/crypto_utils.py#L238-L274","documentation":"ValueError from CryptoUtils.__init__ in common/crypto_utils.py:249-263. The utility supports exactly three cipher suites — aes-128-cbc, aes-256-cbc (default), and sm4-cbc — keyed by the SUPPORTED_ALGORITHMS map. Any other algorithm string passed to the constructor (including typos, algorithm names from other libraries like 'aes-256-gcm', or None with a non-default expectation) fails fast before any key handling.","triggerScenarios":"Instantiating CryptoUtils(algorithm=...) with a value outside {aes-128-cbc, aes-256-cbc, sm4-cbc}. Common in code copied from other crypto tooling that uses GCM/CTR mode names, or config-driven algorithm names with a typo like 'AES-256-CBC' (case-sensitive map).","commonSituations":"Porting encryption code that used AES-GCM elsewhere and assuming RAGFlow supports it; case-mismatched algorithm names from config; upstream config files naming algorithms differently after a version change.","solutions":["Use one of the three supported lowercase names: 'aes-128-cbc', 'aes-256-cbc', or 'sm4-cbc'.","If the value comes from config, correct the config entry to an exact supported string (case-sensitive).","If you truly need GCM/CTR, implement it outside CryptoUtils — do not try to extend the map ad hoc without understanding key/IV handling."],"exampleFix":"# before\nCryptoUtils(algorithm=\"AES-256-GCM\", key=k)\n# after\nCryptoUtils(algorithm=\"aes-256-cbc\", key=k)","handlingStrategy":"validation","validationCode":"SUPPORTED = {\"aes-128-cbc\", \"aes-256-cbc\", \"sm4-cbc\"}\nif algorithm not in SUPPORTED:\n    raise ValueError(f\"unsupported algorithm {algorithm!r}; choose from {sorted(SUPPORTED)}\")","typeGuard":"def is_supported_algorithm(name: str) -> bool:\n    return name in {\"aes-128-cbc\", \"aes-256-cbc\", \"sm4-cbc\"}","tryCatchPattern":"try:\n    cu = CryptoUtils(algorithm=alg, key=key)\nexcept ValueError as e:\n    if \"Unsupported algorithm\" in str(e):\n        alg = \"aes-256-cbc\"  # fall back to default, or prompt for re-entry\n        cu = CryptoUtils(algorithm=alg, key=key)\n    else:\n        raise","preventionTips":["Expose the algorithm as a Literal/enum in config schemas, not a free string.","Remember the map is lowercase and case-sensitive.","Only CBC modes are supported — do not assume parity with other crypto libraries."],"tags":["crypto","validation","configuration"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}