{"record":{"id":"0bbd83f2fc49dd92","repo":"chenhg5/cc-connect","slug":"s-decrypt-w","errorCode":null,"errorMessage":"%s: decrypt: %w","messagePattern":"(.+?): decrypt: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/weixin/cdn.go","lineNumber":163,"sourceCode":"\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"%s: CDN http %d: %s\", label, resp.StatusCode, truncateForLog(body, 256))\n\t}\n\treturn body, nil\n}\n\nfunc downloadAndDecryptCDN(ctx context.Context, client *http.Client, cdnBase, encParam, aesKeyBase64, label string) ([]byte, error) {\n\tkey, err := parseAesKey(aesKeyBase64, label)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tu := buildCdnDownloadURL(encParam, cdnBase)\n\tenc, err := fetchCdnBytes(ctx, client, u, label)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tplain, err := decryptAESECB(enc, key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: decrypt: %w\", label, err)\n\t}\n\treturn plain, nil\n}\n\nfunc downloadPlainCDN(ctx context.Context, client *http.Client, cdnBase, encParam, label string) ([]byte, error) {\n\tu := buildCdnDownloadURL(encParam, cdnBase)\n\treturn fetchCdnBytes(ctx, client, u, label)\n}\n\nconst cdnUploadMaxRetries = 3\n\n// uploadBufferToCDN encrypts plaintext with AES-128-ECB and uploads to the given CDN URL.\n// Caller is responsible for building the full URL (via buildCdnUploadURL or from upload_full_url).\nfunc uploadBufferToCDN(ctx context.Context, client *http.Client, cdnURL string, plaintext, aesKey []byte, label string) (downloadParam string, err error) {\n\tciphertext, err := encryptAESECB(plaintext, aesKey)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"%s: encrypt: %w\", label, err)\n\t}","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/weixin/cdn.go#L145-L181","documentation":"AES-128-ECB decryption of the downloaded CDN ciphertext failed in downloadAndDecryptCDN — typically because the ciphertext is not block-aligned (wrong/truncated data) or PKCS7 unpadding was invalid, meaning the aes_key does not match the media or the download was corrupted.","triggerScenarios":"Thrown at platform/weixin/cdn.go:163 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the aes_key was parsed with the correct interpretation (raw 16 bytes vs hex-wrapped) for this media item","Re-download the ciphertext and retry once in case of corruption","On persistent failure, skip the attachment and notify the user rather than dropping the entire message"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}