{"record":{"id":"d15ceb9f97194471","repo":"jumpserver/jumpserver","slug":"unsupported-sm4-alg-0x-alg-08x","errorCode":null,"errorMessage":"unsupported SM4 alg: 0x{alg:08x}","messagePattern":"unsupported SM4 alg: 0x(.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"apps/common/sdk/gm/sctu/session_mixin.py","lineNumber":139,"sourceCode":"\n        if len(key) == 0 or len(key) % 16 != 0:\n            raise ValueError(\"SM4 external key length must be multiple of 16 bytes\")\n\n        if alg == SGD_SM4_CBC:\n            if iv is None:\n                raise ValueError(\"SM4 CBC mode requires 16 bytes iv\")\n            if not isinstance(iv, (bytes, bytearray)):\n                raise TypeError(\"iv must be bytes or bytearray\")\n            iv = bytes(iv)\n            if len(iv) != 16:\n                raise ValueError(\"SM4 CBC iv must be 16 bytes\")\n            iv_arr = as_uchar_array(iv)\n\n        elif alg == SGD_SM4_ECB:\n            iv_arr = None\n\n        else:\n            raise ValueError(f\"unsupported SM4 alg: 0x{alg:08x}\")\n\n        if encrypt:\n            if padding == PADDING_PKCS7:\n                text = pkcs7_pad(text, 16)\n            elif padding == PADDING_ZERO:\n                text = zero_pad(text, 16)\n            elif padding == PADDING_NONE:\n                if len(text) == 0 or len(text) % 16 != 0:\n                    raise ValueError(\"plain text length must be multiple of 16 bytes when padding is none\")\n            else:\n                raise ValueError(f\"unsupported padding: {padding}\")\n        else:\n            if len(text) == 0 or len(text) % 16 != 0:\n                raise ValueError(\"cipher text length must be multiple of 16 bytes\")\n\n        text_arr = as_uchar_array(text)\n        key_arr = as_uchar_array(key)\n","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/jumpserver/jumpserver/blob/6ec464fabd61b95912d539455a3a5f15f5c59fe0/apps/common/sdk/gm/sctu/session_mixin.py#L121-L157","documentation":"__do_cipher_action only supports SGD_SM4_CBC and SGD_SM4_ECB algorithm identifiers. Any other alg value reaches the else branch and raises ValueError with the unsupported code formatted in hex.","triggerScenarios":"Passing an SM1/SM3/other SGD_ constant, a raw int typo, an uninitialized alg variable (0x00000000), or an alg from a different constant family.","commonSituations":"Refactoring that renamed constants; alg defaulting to None/0 when config omits the field; copy-paste from code using a different SDF SDK with additional modes (CTR, OFB).","solutions":["Use exactly SGD_SM4_CBC or SGD_SM4_ECB","Validate/normalize alg at config load and fail fast on unknown values","Add logging of alg before the call when debugging"],"exampleFix":"# before\nct = session.encrypt(data, key, alg=0x00000102)  # wrong constant\n\n# after\nfrom ...constants import SGD_SM4_CBC\nct = session.encrypt(data, key, alg=SGD_SM4_CBC, iv=iv)","handlingStrategy":"validation","validationCode":"SUPPORTED_ALGS = (SGD_SM4_CBC, SGD_SM4_ECB)\nif alg not in SUPPORTED_ALGS:\n    raise ValueError(f'unsupported SM4 alg: 0x{alg:08x}')","typeGuard":"def is_supported_alg(a) -> bool:\n    return a in (SGD_SM4_CBC, SGD_SM4_ECB)","tryCatchPattern":null,"preventionTips":["Import alg constants from the SDK, never hardcode ints","Validate config-driven alg values at startup"],"tags":["gm","crypto","sm4","algorithm","validation"],"backgroundTag":"unsupported-algorithm","analyzedSha":"6ec464fabd61b95912d539455a3a5f15f5c59fe0","analyzedAt":"2026-08-28T11:33:00.925Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}