{"record":{"id":"c119acc1e2d4c097","repo":"phalcon/cphalcon","slug":"unknown-hashing-algorithm","errorCode":null,"errorMessage":"Unknown hashing algorithm: {}","messagePattern":"Unknown hashing algorithm: (.+?)","errorType":"exception","errorClass":"UnknownHashAlgorithm","httpStatus":null,"severity":"error","filePath":"phalcon/Encryption/Security.zep","lineNumber":273,"sourceCode":"     * @param string $key\n     * @param string $algo\n     * @param bool   $raw\n     *\n     * @return string\n     * @throws Exception\n     */\n    public function computeHmac(\n        string data,\n        string key,\n        string algorithm,\n        bool raw = false\n    ) -> string {\n        var hmac;\n\n        try {\n            let hmac = this->phpHashHmac(algorithm, data, key, raw);\n        } catch \\ValueError {\n            throw new UnknownHashAlgorithm(algorithm);\n        }\n\n        if unlikely !hmac {\n            throw new UnknownHashAlgorithm(algorithm);\n        }\n\n        return hmac;\n    }\n\n    /**\n     * Removes the value of the CSRF token and key from session\n     */\n    public function destroyToken() -> <static>\n    {\n        var session;\n\n        let session = this->getLocalService(\"session\", \"localSession\");\n","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Encryption/Security.zep#L255-L291","documentation":"Security::computeHmac() wraps hash_hmac(): on PHP 8 an unknown algorithm throws ValueError, which Phalcon catches and rethrows as UnknownHashAlgorithm; additionally an empty/false HMAC result (PHP 7 behavior for unknown algorithms) triggers the same exception. The message interpolates the algorithm name: \"Unknown hashing algorithm: {algo}\".","triggerScenarios":"Calling $security->computeHmac($data, $key, 'sha2565') / 'md6' / 'haval typo' etc. - any string not in hash_algos(); also algorithms valid for hash() but not accepted by hash_hmac(). Values like 'SHA256' (uppercase) ARE valid since hash_hmac is case-insensitive for known names.","commonSituations":"Algorithm names pulled from configuration or user input and never validated; copy-pasted algorithm identifiers with invisible whitespace or wrong casing variants ('sha-256' with a hyphen is NOT a valid PHP name - it is 'sha256'); interop code copying algorithm names from other ecosystems (Node 'sha256' is fine, but JWT 'HS256' is not).","solutions":["Use canonical PHP names: 'md5', 'sha1', 'sha256', 'sha512' - and strip whitespace: trim($algo).","Validate before calling: in_array($algo, hash_algos(), true) (case-sensitive list, so lowercase first).","If the algorithm arrives from outside (config, headers), map external names to PHP names ('HS256' -> 'sha256') via a lookup table instead of passing them through."],"exampleFix":"// before\n$hmac = $security->computeHmac($payload, $key, 'sha-256'); // hyphenated -> throws\n\n// after\n$algo = 'sha256'; // canonical hash_algos() name\nif (!in_array($algo, hash_algos(), true)) {\n    throw new \\InvalidArgumentException('Unsupported HMAC algorithm');\n}\n$hmac = $security->computeHmac($payload, $key, $algo);","handlingStrategy":"validation","validationCode":"$algo = strtolower(trim($algorithm));\nif (!in_array($algo, hash_algos(), true)) {\n    throw new \\InvalidArgumentException(\"Unsupported hash algorithm '{$algorithm}'\");\n}\n$hmac = $security->computeHmac($data, $key, $algo);","typeGuard":"function isValidHashAlgorithm(string $algorithm): bool\n{\n    return in_array(strtolower(trim($algorithm)), hash_algos(), true);\n}","tryCatchPattern":"try {\n    $hmac = $security->computeHmac($data, $key, $algo);\n} catch (\\Phalcon\\Encryption\\Security\\Exceptions\\UnknownHashAlgorithm $e) {\n    throw new \\InvalidArgumentException('Unsupported HMAC algorithm: ' . $algo, 0, $e);\n}","preventionTips":["Whitelist algorithms ('sha256', 'sha512') instead of accepting arbitrary strings from config or request headers.","Map external algorithm names (JWT 'HS256' -> 'sha256') through a lookup table.","Normalize with trim + strtolower before validating; hash_hmac accepts known names case-insensitively but your whitelist should not rely on that."],"tags":["phalcon","security","hmac","hash","algorithm-name"],"backgroundTag":"unknown-hash-algorithm","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}