{"record":{"id":"f587febbe24406ea","repo":"PHPOffice/PHPWord","slug":"salt-has-to-be-of-exactly-16-bytes-length","errorCode":null,"errorMessage":"salt has to be of exactly 16 bytes length","messagePattern":"salt has to be of exactly 16 bytes length","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"src/PhpWord/Metadata/Protection.php","lineNumber":199,"sourceCode":"     *\n     * @return string\n     */\n    public function getSalt()\n    {\n        return $this->salt;\n    }\n\n    /**\n     * Set salt. Salt HAS to be 16 characters, or an exception will be thrown.\n     *\n     * @param string $salt\n     *\n     * @return self\n     */\n    public function setSalt($salt)\n    {\n        if ($salt !== null && strlen($salt) !== 16) {\n            throw new InvalidArgumentException('salt has to be of exactly 16 bytes length');\n        }\n\n        $this->salt = $salt;\n\n        return $this;\n    }\n}\n","sourceCodeStart":181,"sourceCodeEnd":207,"githubUrl":"https://github.com/PHPOffice/PHPWord/blob/aef95c04151b5633cc505f672ddd6a71da900ee1/src/PhpWord/Metadata/Protection.php#L181-L207","documentation":"Metadata\\Protection::setSalt validates that the salt used for password hashing is exactly 16 bytes. A null salt is allowed (no protection), but any non-null string of a different length is rejected because the underlying hashing algorithm expects a 16-byte salt.","triggerScenarios":"Calling setSalt() with a string shorter or longer than 16 characters, e.g. setSalt('shortsalt') or passing a hex string of 32 chars.","commonSituations":"Generating a salt with a function that returns a non-16-byte value; passing a UUID or hex-encoded bytes instead of raw 16 bytes; hand-typed salts in config.","solutions":["Pass exactly 16 raw bytes, e.g. random_bytes(16)","If you have hex, decode it first (hex2bin) so the result is 16 bytes","Pass null explicitly if you want no salt rather than an empty string"],"exampleFix":"// before\n$protection->setSalt('mysalt');\n// after\n$protection->setSalt(random_bytes(16));","handlingStrategy":"validation","validationCode":"if ($salt !== null && strlen($salt) !== 16) { throw new \\InvalidArgumentException('Salt must be 16 bytes'); }","typeGuard":null,"tryCatchPattern":"try { $protection->setSalt($salt); } catch (\\InvalidArgumentException $e) { $protection->setSalt(random_bytes(16)); }","preventionTips":["Always use random_bytes(16) for salts","Never pass hex-encoded or textual salts directly","Pass null explicitly for no salt"],"tags":["phpword","validation","salt"],"backgroundTag":"invalid-argument-value","analyzedSha":"aef95c04151b5633cc505f672ddd6a71da900ee1","analyzedAt":"2026-09-14T10:53:58.933Z","contentChangedAt":"2026-09-14T10:53:58.933Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}