{"record":{"id":"0d82e058fe443f30","repo":"fish2018/pansou","slug":"error-0d82e0","errorCode":null,"errorMessage":"密文长度不足","messagePattern":"密文长度不足","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/panlian/panlian.go","lineNumber":1864,"sourceCode":"\tciphertext := gcm.Seal(nonce, nonce, []byte(password), nil)\n\treturn base64.StdEncoding.EncodeToString(ciphertext), nil\n}\n\nfunc (p *PanlianPlugin) decryptPassword(encrypted string) (string, error) {\n\tdata, err := base64.StdEncoding.DecodeString(encrypted)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tblock, err := aes.NewCipher(getEncryptionKey())\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif len(data) < gcm.NonceSize() {\n\t\treturn \"\", fmt.Errorf(\"密文长度不足\")\n\t}\n\tnonce := data[:gcm.NonceSize()]\n\tciphertext := data[gcm.NonceSize():]\n\tplaintext, err := gcm.Open(nil, nonce, ciphertext, nil)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn string(plaintext), nil\n}\n","sourceCodeStart":1846,"sourceCodeEnd":1874,"githubUrl":"https://github.com/fish2018/pansou/blob/beaa56133755a548ebc51b090b3816e2ae044aa6/plugin/panlian/panlian.go#L1846-L1874","documentation":"The AES-GCM decryption helper checks that the ciphertext blob is at least as long as the GCM nonce size before splitting it. If the input data is shorter than gcm.NonceSize(), decryption cannot proceed and this error is returned.","triggerScenarios":"Decrypting an empty string, a plaintext value mistakenly passed as ciphertext, a truncated/corrupted stored credential, or data that was not produced by the matching encrypt function.","commonSituations":"Config/db credential field empty or overwritten with plaintext; base64 decoding producing wrong bytes (wrong encoding, whitespace); manual copy-paste losing characters; encrypt/decrypt key or format version mismatch.","solutions":["Verify the stored credential is a complete ciphertext produced by the matching encrypt helper (re-encrypt the source value)","Check that base64/hex decoding happens before decryption and that no characters were lost","Confirm the same key is used for encryption and decryption so the blob is not misinterpreted","Add a length check on the caller side before attempting decryption"],"exampleFix":"// before\nplain, err := decrypt(cfg.Password)\nif err != nil { return err }\n// after\nif len(cfg.Password) < 28 { // nonce(12) + tag(16), pre-encoded sanity check\n    return errors.New(\"存储的密码密文缺失或为空，请重新配置\")\n}\nplain, err := decrypt(cfg.Password)\nif err != nil { return err }","handlingStrategy":"validation","validationCode":"raw, err := base64.StdEncoding.DecodeString(enc)\nif err != nil {\n    return fmt.Errorf(\"credential is not valid base64 ciphertext: %w\", err)\n}\nif len(raw) < 12+16 {\n    return errors.New(\"ciphertext too short; re-encrypt the value\")\n}","typeGuard":null,"tryCatchPattern":"plain, err := decrypt(enc)\nif err != nil {\n    if err.Error() == \"密文长度不足\" {\n        return errors.New(\"stored credential missing/corrupted; reconfigure password\")\n    }\n    return err\n}","preventionTips":["Only store values produced by the matching encrypt helper","Base64-decode and length-check ciphertext at config load","Never pass plaintext or empty strings into the decrypt path"],"tags":["crypto","aes-gcm","decryption","go"],"backgroundTag":"invalid-argument-format","analyzedSha":"beaa56133755a548ebc51b090b3816e2ae044aa6","analyzedAt":"2026-09-07T00:31:18.025Z","contentChangedAt":"2026-09-07T00:31:18.025Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}