{"record":{"id":"26b05f15924f9637","repo":"chenhg5/cc-connect","slug":"s-aes-key-hex-inside-base64-w","errorCode":null,"errorMessage":"%s: aes_key hex inside base64: %w","messagePattern":"(.+?): aes_key hex inside base64: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/weixin/cdn.go","lineNumber":104,"sourceCode":"\t}\n\treturn pkcs7Unpad(out, aes.BlockSize)\n}\n\n// parseAesKey decodes CDNMedia.aes_key: base64(raw 16 bytes) or base64(32-char hex ASCII) → 16 bytes.\nfunc parseAesKey(aesKeyBase64, label string) ([]byte, error) {\n\tdecoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(aesKeyBase64))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: aes_key base64: %w\", label, err)\n\t}\n\tif len(decoded) == 16 {\n\t\treturn decoded, nil\n\t}\n\tif len(decoded) == 32 {\n\t\ts := string(decoded)\n\t\tif hex32RE.MatchString(s) {\n\t\t\tk, err := hex.DecodeString(s)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"%s: aes_key hex inside base64: %w\", label, err)\n\t\t\t}\n\t\t\treturn k, nil\n\t\t}\n\t}\n\treturn nil, fmt.Errorf(\"%s: aes_key must be 16 raw bytes or 32-char hex (base64-wrapped), got %d bytes after base64\", label, len(decoded))\n}\n\nfunc buildCdnDownloadURL(encryptedQueryParam, cdnBase string) string {\n\treturn fmt.Sprintf(\"%s/download?encrypted_query_param=%s\",\n\t\tstrings.TrimRight(cdnBase, \"/\"),\n\t\turl.QueryEscape(encryptedQueryParam))\n}\n\nfunc buildCdnUploadURL(cdnBase, uploadParam, filekey string) string {\n\treturn fmt.Sprintf(\"%s/upload?encrypted_query_param=%s&filekey=%s\",\n\t\tstrings.TrimRight(cdnBase, \"/\"),\n\t\turl.QueryEscape(uploadParam),\n\t\turl.QueryEscape(filekey))","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/weixin/cdn.go#L86-L122","documentation":"Inside parseAesKey, the base64-decoded aes_key was 32 bytes of ASCII that matched the hex pattern, but hex.DecodeString still failed — theoretically impossible after regex validation, so this indicates corrupt data or a regex/decoder mismatch on the CDN media key.","triggerScenarios":"Thrown at platform/weixin/cdn.go:104 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Log the offending decoded string (it is key material metadata, not a secret payload) to see why hex decoding rejects it","Tighten or replace hex32RE so it exactly matches hex.DecodeString's accepted alphabet (0-9a-f, case handling)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}