Rules / PHP
SHIELD-PHP-013
Insecure legacy encryption (mcrypt DES/ECB)
What it detects
Deprecated mcrypt with DES or ECB mode provides weak, insecure encryption.
How to fix
Use openssl or sodium with AES-GCM or a modern authenticated cipher.
Vulnerable — Shield flags thiscrypto.php
<?php
// Legacy session encryption — DES in ECB mode leaks plaintext patterns
function encryptSessionData(string $data, string $key): string {
$ciphertext = mcrypt_encrypt(MCRYPT_DES, $key, $data, MCRYPT_MODE_ECB);
return base64_encode($ciphertext);
}
Fixed — scans cleancrypto.php
<?php
// AES-256-GCM — modern authenticated encryption via OpenSSL
function encryptSessionData(string $data, string $key): string {
$iv = random_bytes(12);
$ciphertext = openssl_encrypt($data, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag);
return base64_encode($iv . $tag . $ciphertext);
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-013, the fixed one does not.