{"record":{"id":"30d57acacc2f7646","repo":"JeffreySu/WeiXinMPSDK","slug":"resource-algorithm","errorCode":null,"errorMessage":"不支持的通知资源加密算法：{resource.algorithm}","messagePattern":"不支持的通知资源加密算法：(.+?)","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Senparc.Weixin.Work/Senparc.Weixin.Work/Entities/Request/Event/RequestMessageEvent_MiniProgramPay.cs","lineNumber":82,"sourceCode":"        public string DecryptResource(string encodingAesKey)\n        {\n#if NET462 || NETSTANDARD2_0\n            throw new PlatformNotSupportedException(\n                \"当前目标框架不提供 AES-GCM。请在 netstandard2.1、netcoreapp3.1 或更新目标中解密通知资源。\");\n#else\n            if (string.IsNullOrEmpty(encodingAesKey) || encodingAesKey.Length != 43)\n            {\n                throw new ArgumentException(\"EncodingAESKey 必须为 43 个字符。\", nameof(encodingAesKey));\n            }\n\n            if (resource == null)\n            {\n                throw new InvalidOperationException(\"通知中不包含 resource 节点。\");\n            }\n\n            if (!string.Equals(resource.algorithm, \"AEAD_AES_256_GCM\", StringComparison.OrdinalIgnoreCase))\n            {\n                throw new NotSupportedException($\"不支持的通知资源加密算法：{resource.algorithm}\");\n            }\n\n            var key = Convert.FromBase64String(encodingAesKey + \"=\");\n            var encrypted = Convert.FromBase64String(resource.ciphertext);\n            const int tagSize = 16;\n            if (encrypted.Length <= tagSize)\n            {\n                throw new CryptographicException(\"通知资源密文长度无效。\");\n            }\n\n            var ciphertext = new byte[encrypted.Length - tagSize];\n            var tag = new byte[tagSize];\n            var plaintext = new byte[ciphertext.Length];\n            Buffer.BlockCopy(encrypted, 0, ciphertext, 0, ciphertext.Length);\n            Buffer.BlockCopy(encrypted, ciphertext.Length, tag, 0, tag.Length);\n\n            try\n            {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/JeffreySu/WeiXinMPSDK/blob/be573f6f94bdbf718dd5f6cdecb137fbc7ff651e/src/Senparc.Weixin.Work/Senparc.Weixin.Work/Entities/Request/Event/RequestMessageEvent_MiniProgramPay.cs#L64-L100","documentation":"AES-GCM decryption in this library only supports WeChat Work's mandated algorithm `AEAD_AES_256_GCM`. When resource.algorithm is anything else (or missing), the library refuses to attempt decryption with NotSupportedException, since the key/tag layout would be wrong.","triggerScenarios":"Calling DecryptResource when the notification's resource.algorithm field is null, empty, or a value other than AEAD_AES_256_GCM (case-insensitive).","commonSituations":"WeChat platform changes the algorithm for new event types; malformed or forged callbacks in production; unit tests that stub a resource with a placeholder algorithm string.","solutions":["Inspect the raw notification and confirm resource.algorithm is AEAD_AES_256_GCM","If WeChat introduced a new algorithm, update the library or decrypt manually with a matching implementation","Treat non-matching algorithm callbacks as invalid/suspect and reject them at the webhook boundary"],"exampleFix":"// before\nvar plain = message.DecryptResource(aesKey);\n// after\nif (message.Resource?.algorithm?.Equals(\"AEAD_AES_256_GCM\", StringComparison.OrdinalIgnoreCase) != true)\n    return; // unsupported algorithm, log & reject\nvar plain = message.DecryptResource(aesKey);","handlingStrategy":"validation","validationCode":"if (!string.Equals(message.Resource?.algorithm, \"AEAD_AES_256_GCM\", StringComparison.OrdinalIgnoreCase))\n    throw new NotSupportedException($\"unsupported algorithm: {message.Resource?.algorithm}\");","typeGuard":null,"tryCatchPattern":"try { var plain = msg.DecryptResource(aesKey); }\ncatch (NotSupportedException ex) { log.Warn(ex.Message); return Results.StatusCode(400); } // reject suspect callback","preventionTips":["Validate resource.algorithm == AEAD_AES_256_GCM before decrypting","Reject (don't retry) callbacks with unknown algorithms — they may be forged or protocol changes","Subscribe to WeChat Work platform announcements for algorithm changes"],"tags":["cryptography","unsupported-enum-value","webhook"],"backgroundTag":"unsupported-enum-value","analyzedSha":"be573f6f94bdbf718dd5f6cdecb137fbc7ff651e","analyzedAt":"2026-09-12T10:01:50.733Z","contentChangedAt":"2026-09-12T10:01:50.733Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}