[#47533] - [5.4] Fix ECB mode validation typo in OpenSSL AES adapter and align related docs
- Fixed in Code Base
- 9 May 2026
- Medium
- Build: 5.4-dev
- # 47533
- Diff
- mateeaaa:5.4-dev
User tests: Successful: Unsuccessful:
Pull Request resolves # .
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
This PR fixes a mode-validation typo in the OpenSSL AES adapter that caused valid ecb input to be rejected, adds a regression test, and aligns related AES documentation comments.
Functional fix in OpenSSL.php:90 mode allowlist now accepts ecb instead of the misspelled ebc.
Regression test added in OpenSSLTest.php:30.
###Discovery/Triage
This issue was initially identified during a Semgrep-assisted review and then manually validated.
Testing Instructions
- Install dependencies:
- Run the focused regression test:
- Optional syntax checks:
php -l libraries/src/Encrypt/AES/OpenSSL.php
php -l tests/Unit/Libraries/Cms/Encrypt/AES/OpenSSLTest.php
###Actual result BEFORE applying this Pull Request
- Calling setEncryptionMode("ecb", 128) was treated as invalid because the allowlist expected ebc.
- The adapter silently fell back to cbc/default behavior.
- Requested ECB mode was not selected.
###Expected result AFTER applying this Pull Request
- Calling setEncryptionMode("ecb", 128) is accepted.
- The adapter selects aes-128-ecb as expected (when supported by the OpenSSL build).
- Regression test passes and guards against reintroduction.
Link to documentations
Please select:
-
Documentation link for guide.joomla.org:
-
No documentation changes for guide.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Libraries Unit Tests |
| Title |
|
||||||
| Labels |
Added:
Unit/System Tests
Updates Requested
bug
PR-5.4-dev
|
||
| Labels |
Removed:
Updates Requested
|
||
@mateeaaaaaaa Please confirm the AI policy by checking the check box (replacing the space inside the squared brackets by a capital X).
P.S.: ... and apply my 3 change suggestions.
I’ve allowed myself to apply my review suggestions.
@mateeaaa As mentioned in my previous comment, I have allowed myself to apply some code style suggestions.
There is one more thing you could do. Could you remove the new unit test (file tests/Unit/Libraries/Cms/Encrypt/AES/OpenSSLTest.php) from your PR?
It might have been useful for testing your PR, but besides that it is not really useful as it tests just this one case and uses reflection. Unit tests should test the public interface of a class. That might not be possible for the issue fixed by your PR.
Besides this, your PR is fine.
| Labels |
Added:
Updates Requested
|
||
| Category | Libraries Unit Tests | ⇒ | Libraries |
@mateeaaa As mentioned in my previous comment, I have allowed myself to apply some code style suggestions.
There is one more thing you could do. Could you remove the new unit test (file
tests/Unit/Libraries/Cms/Encrypt/AES/OpenSSLTest.php) from your PR?It might have been useful for testing your PR, but besides that it is not really useful as it tests just this one case and uses reflection. Unit tests should test the public interface of a class. That might not be possible for the issue fixed by your PR.
Besides this, your PR is fine.
As there was no reaction by the author, I've allowed myself to apply the requested change (removal of the not useful new unit test).
| Labels |
Removed:
Unit/System Tests
Updates Requested
|
||
| Status | Pending | ⇒ | Ready to Commit |
RTC as it has 3 approvals by maintainers and cannot really be tested by end users.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47533.
RTC as it has 3 approvals by maintainers and cannot really be tested by end users.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47533.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-05-09 14:40:19 |
| Closed_By | ⇒ | richard67 | |
| Labels |
Added:
RTC
|
||
@mateeaaaaaaa Please confirm the AI policy by checking the check box (replacing the space inside the squared brackets by a capital X).
P.S.: ... and apply my 3 change suggestions.