{"record":{"id":"eb96f3cda234835e","repo":"grafana/k6","slug":"invalid-size","errorCode":null,"errorMessage":"invalid size","messagePattern":"invalid size","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/crypto/crypto.go","lineNumber":79,"sourceCode":"\t\t\t\"md4\":         c.md4,\n\t\t\t\"md5\":         c.md5,\n\t\t\t\"randomBytes\": c.randomBytes,\n\t\t\t\"ripemd160\":   c.ripemd160,\n\t\t\t\"sha1\":        c.sha1,\n\t\t\t\"sha256\":      c.sha256,\n\t\t\t\"sha384\":      c.sha384,\n\t\t\t\"sha512\":      c.sha512,\n\t\t\t\"sha512_224\":  c.sha512_224,\n\t\t\t\"sha512_256\":  c.sha512_256,\n\t\t\t\"hexEncode\":   c.hexEncode,\n\t\t},\n\t}\n}\n\n// randomBytes returns random data of the given size.\nfunc (c *Crypto) randomBytes(size int) (*sobek.ArrayBuffer, error) {\n\tif size < 1 {\n\t\treturn nil, errors.New(\"invalid size\")\n\t}\n\tbytes := make([]byte, size)\n\t_, err := c.randReader(bytes)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tab := c.vu.Runtime().NewArrayBuffer(bytes)\n\treturn &ab, nil\n}\n\n// md4 returns the MD4 hash of input in the given encoding.\nfunc (c *Crypto) md4(input any, outputEncoding string) (any, error) {\n\treturn c.buildInputsDigest(\"md4\", input, outputEncoding)\n}\n\n// md5 returns the MD5 hash of input in the given encoding.\nfunc (c *Crypto) md5(input any, outputEncoding string) (any, error) {\n\treturn c.buildInputsDigest(\"md5\", input, outputEncoding)","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/js/modules/k6/crypto/crypto.go#L61-L97","documentation":"crypto.randomBytes(size) returns `size` cryptographically random bytes as an ArrayBuffer. Any size below 1 — zero or negative — is rejected with 'invalid size' (crypto.go:76-83) because an empty or negative-length buffer is meaningless.","triggerScenarios":"crypto.randomBytes(0) or crypto.randomBytes(-3); a size computed from data or configuration that evaluates to 0 or negative (empty array length, misparsed env var, off-by-one math).","commonSituations":"Parameterized token/salt lengths driven by env vars that default to 0; generating nonces sized from dataset counts; arithmetic like length - 1 on an empty input.","solutions":["Pass a positive integer size, e.g. crypto.randomBytes(16)","Clamp and validate before the call: const n = Math.max(1, parseInt(size))","Check the data source feeding the size (env var, config file) for empty or missing values"],"exampleFix":"// before\nconst bytes = crypto.randomBytes(input.length - 1); // -1 when input is empty\n\n// after\nconst n = Math.max(1, input.length - 1);\nconst bytes = crypto.randomBytes(n);","handlingStrategy":"validation","validationCode":"const size = Math.max(1, Math.floor(Number(rawSize)));\nif (!Number.isFinite(size)) throw new Error('randomBytes size must be a positive integer');\nconst buf = crypto.randomBytes(size);","typeGuard":"const isValidByteSize = (n) => Number.isInteger(n) && n >= 1;","tryCatchPattern":null,"preventionTips":["Validate length inputs from env/config before deriving byte sizes","Guard arithmetic like length - 1 against empty inputs","Default configurable sizes to sane positive values (e.g. 16 or 32)"],"tags":["crypto","validation","k6"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}