{"record":{"id":"16ba2b9cef6ecc62","repo":"chenhg5/cc-connect","slug":"wecom-ws-aeskey-hex-length-d-want-32-bytes","errorCode":null,"errorMessage":"wecom-ws: aeskey hex length %d, want 32 bytes","messagePattern":"wecom-ws: aeskey hex length (.+?), want 32 bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/wecom/websocket_media.go","lineNumber":227,"sourceCode":"\tvar b strings.Builder\n\tb.Grow(len(s))\n\tfor i := 0; i < len(s); i++ {\n\t\tswitch s[i] {\n\t\tcase '\\n', '\\r', ' ', '\\t':\n\t\t\tcontinue\n\t\tdefault:\n\t\t\tb.WriteByte(s[i])\n\t\t}\n\t}\n\ts = b.String()\n\n\tif len(s) == 64 && isHexString(s) {\n\t\tkey, err := hex.DecodeString(s)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"wecom-ws: decode aeskey hex: %w\", err)\n\t\t}\n\t\tif len(key) != 32 {\n\t\t\treturn nil, fmt.Errorf(\"wecom-ws: aeskey hex length %d, want 32 bytes\", len(key))\n\t\t}\n\t\treturn key, nil\n\t}\n\n\t// URL-safe alphabet → standard (RFC 4648 §5)\n\ts = strings.ReplaceAll(s, \"-\", \"+\")\n\ts = strings.ReplaceAll(s, \"_\", \"/\")\n\n\tswitch len(s) % 4 {\n\tcase 0:\n\tcase 2:\n\t\ts += \"==\"\n\tcase 3:\n\t\ts += \"=\"\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"wecom-ws: invalid aeskey base64 length\")\n\t}\n","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/wecom/websocket_media.go#L209-L245","documentation":"Length check inside decodeWeComAESKey's hex branch: the 64 hex characters decoded successfully but did not yield the 32 bytes required for AES-256. Since 64 hex chars always decode to 32 bytes, this guard is a defensive invariant — firing it means the decoder or the preceding isHexString/length checks are inconsistent.","triggerScenarios":"Thrown at platform/wecom/websocket_media.go:227 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Treat as a defensive assertion failure: log loudly and investigate rather than papering over","Skip decryption for the affected media item so the rest of the message still delivers","Keep the guard as a safety net; no configuration change can trigger it under correct hex arithmetic"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}