{"record":{"id":"ce150da11dc2b21a","repo":"grafana/k6","slug":"invalid-block-size","errorCode":null,"errorMessage":"invalid block size","messagePattern":"invalid block size","errorType":"validation","errorClass":"ErrInvalidBlockSize","httpStatus":null,"severity":"info","filePath":"internal/js/modules/k6/webcrypto/aes.go","lineNumber":658,"sourceCode":"//\n// [Web Crypto API spec]: https://www.w3.org/TR/WebCryptoAPI/#aes-gcm-encryption-operation\nconst maxAESGCMPlaintextLength uint64 = (1 << 39) - 256\n\n// maxAESGcmAdditionalDataLength holds the value 2 ^ 64 - 1 as specified in\n// the [Web Crypto API spec] for the AES-GCM algorithm encryption operation.\n//\n// [Web Crypto API spec]: https://www.w3.org/TR/WebCryptoAPI/#aes-gcm-encryption-operation\nconst maxAESGcmAdditionalDataLength uint64 = (1 << 64) - 1\n\n// maxAESGcmIvLength holds the value 2 ^ 64 - 1 as specified in\n// the [Web Crypto API spec] for the AES-GCM algorithm encryption operation.\n//\n// [Web Crypto API spec]: https://www.w3.org/TR/WebCryptoAPI/#aes-gcm-encryption-operation\nconst maxAESGcmIvLength uint64 = (1 << 64) - 1\n\nvar (\n\t// ErrInvalidBlockSize is returned when the given block size is invalid.\n\tErrInvalidBlockSize = errors.New(\"invalid block size\")\n\n\t// ErrInvalidPkcs7Data is returned when the given data is invalid.\n\tErrInvalidPkcs7Data = errors.New(\"invalid PKCS7 data\")\n)\n\n// pKCS7Padding adds PKCS7 padding to the given plaintext.\n// It implements section 10.3 of [RFC 2315].\n//\n// [RFC 2315]: https://www.rfc-editor.org/rfc/rfc2315#section-10.3\nfunc pKCS7Pad(plaintext []byte, blockSize int) ([]byte, error) {\n\tif blockSize <= 0 {\n\t\treturn nil, ErrInvalidBlockSize\n\t}\n\n\tif len(plaintext) == 0 {\n\t\treturn nil, ErrInvalidPkcs7Data\n\t}\n","sourceCodeStart":640,"sourceCodeEnd":676,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/webcrypto/aes.go#L640-L676","documentation":"ErrInvalidBlockSize is returned by the PKCS#7 padding helper pKCS7Pad (internal/js/modules/k6/webcrypto/aes.go:668) when blockSize <= 0. Its only production call site (aes.go:286) passes the constant aes.BlockSize (16), so through the public crypto.subtle API this error is effectively unreachable — it is a defensive invariant guarding the internal AES-CBC encrypt path (RFC 2315 section 10.3 padding).","triggerScenarios":"Not reachable via `crypto.subtle.encrypt(...)` with AES-CBC in a normal build; would only occur from an internal regression, a patched/forked k6 that passes a different block size, or direct Go use of the helper.","commonSituations":"Hitting this in practice almost always means a non-standard k6 build or an internal bug introduced by custom patches — it is not a user-input error.","solutions":["If using a custom/forked k6, verify the AES-CBC path still passes aes.BlockSize (16)","Report a bug to k6 (https://github.com/grafana/k6/issues) with the script and k6 version, since stock builds cannot produce it","Pin a known-good k6 version while investigating"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const ct = await crypto.subtle.encrypt({ name: 'AES-CBC', iv }, key, data);\n} catch (e) {\n  if (String(e.message).includes('invalid block size')) throw new Error('internal k6 webcrypto error — report at github.com/grafana/k6/issues');\n  throw e;\n}","preventionTips":["Treat this error as an internal invariant failure, not a script bug","Pin the k6 version in CI so a regression is caught immediately","When forking k6, keep the pKCS7Pad call site passing aes.BlockSize (16)"],"tags":["webcrypto","aes","internal","defensive"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}