{"record":{"id":"d175e187507e3707","repo":"abpframework/abp","slug":"unknown-blob-encryption-key-source-source","errorCode":null,"errorMessage":"Unknown BLOB encryption key source: {source}!","messagePattern":"Unknown BLOB encryption key source: (.+?)!","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKey.cs","lineNumber":33,"sourceCode":"    public BlobEncryptionKeySource Source { get; }\n\n    /// <summary>\n    /// The passphrase the encryption key of the BLOB is derived from.\n    /// </summary>\n    [NotNull]\n    public string PassPhrase { get; }\n\n    /// <summary>\n    /// Creates the resolved key; <paramref name=\"source\"/> must be a defined\n    /// <see cref=\"BlobEncryptionKeySource\"/> value and the passphrase non-empty.\n    /// </summary>\n    public BlobEncryptionKey(BlobEncryptionKeySource source, [NotNull] string passPhrase)\n    {\n        if (source < BlobEncryptionKeySource.Container || source > BlobEncryptionKeySource.Global)\n        {\n            // The source is stored in the BLOB header and validated while reading;\n            // an unknown value would make the BLOB permanently unreadable.\n            throw new ArgumentException($\"Unknown BLOB encryption key source: {source}!\", nameof(source));\n        }\n\n        Source = source;\n        PassPhrase = Check.NotNullOrWhiteSpace(passPhrase, nameof(passPhrase));\n    }\n}\n","sourceCodeStart":15,"sourceCodeEnd":40,"githubUrl":"https://github.com/abpframework/abp/blob/7ed43b1931b9df46a50c0c59148a18645641d0df/framework/src/Volo.Abp.BlobStoring/Volo/Abp/BlobStoring/BlobEncryptionKey.cs#L15-L40","documentation":"BlobEncryptionKey's constructor validates that source is within the defined BlobEncryptionKeySource range (Container..Global). The source is persisted in the BLOB header, so an out-of-range value would make the BLOB permanently unreadable; the ctor rejects it with an ArgumentException.","triggerScenarios":"Constructing BlobEncryptionKey with an undefined BlobEncryptionKeySource value — typically by casting an invalid integer to the enum, or deserializing a BLOB header whose source byte is outside the known range.","commonSituations":"A future ABP version writes a new source value that an older reader casts to an undefined enum; a corrupted/tampered header byte; manual/reflective code that casts arbitrary ints to BlobEncryptionKeySource.","solutions":["Validate the enum with Enum.IsDefined before constructing BlobEncryptionKey.","On decrypt, treat an unknown source as a version mismatch and surface a clear 'BLOB written by a newer version' error.","Re-encrypt the BLOB with a known-valid source value.","Do not cast raw ints to BlobEncryptionKeySource without range-checking."],"exampleFix":"// before\nvar key = new BlobEncryptionKey((BlobEncryptionKeySource)rawHeaderByte, pass);\n\n// after\nif (!Enum.IsDefined(typeof(BlobEncryptionKeySource), rawHeaderByte))\n    throw new InvalidOperationException(\n        $\"BLOB written by a newer/incompatible version (source={rawHeaderByte}).\");\nvar key = new BlobEncryptionKey((BlobEncryptionKeySource)rawHeaderByte, pass);","handlingStrategy":"validation","validationCode":"// Validate the source byte before constructing a BlobEncryptionKey.\nstatic BlobEncryptionKey BuildKey(int rawSource, string pass)\n{\n    if (!Enum.IsDefined(typeof(BlobEncryptionKeySource), rawSource))\n        throw new InvalidDataException(\n            $\"BLOB header references unknown key source {rawSource}; written by a newer/incompatible version.\");\n    return new BlobEncryptionKey((BlobEncryptionKeySource)rawSource, pass);\n}","typeGuard":"public static bool IsDefinedSource(int raw) =>\n    Enum.IsDefined(typeof(BlobEncryptionKeySource), raw);\n\n// usage before construct:\nif (!IsDefinedSource(rawHeaderByte)) return Result.UnknownVersion;","tryCatchPattern":"try\n{\n    var key = new BlobEncryptionKey((BlobEncryptionKeySource)rawHeaderByte, pass);\n}\ncatch (ArgumentException ex) when (ex.Message.Contains(\"Unknown BLOB encryption key source\"))\n{\n    logger.LogError(ex, \"BLOB header is corrupt or from an incompatible version (source={Source}).\", rawHeaderByte);\n    // Surface a version-mismatch error to the user; not retryable.\n    throw;\n}","preventionTips":["Never cast raw ints to BlobEncryptionKeySource without Enum.IsDefined.","Treat unknown source bytes as version mismatches and surface a clear error.","Keep writer and reader codec versions aligned across deployments.","Validate headers defensively when reading externally produced BLOBs."],"tags":["crypto","configuration","enum","validation","versioning"],"backgroundTag":null,"analyzedSha":"7ed43b1931b9df46a50c0c59148a18645641d0df","analyzedAt":"2026-08-13T16:26:11.351Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}