{"record":{"id":"32a21bf2369cad5b","repo":"iflytek/astron-agent","slug":"encrypted-data-cannot-be-empty","errorCode":null,"errorMessage":"Encrypted data cannot be empty","messagePattern":"Encrypted data cannot be empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WechatMessageCrypto.java","lineNumber":38,"sourceCode":"\n    public WechatMessageCrypto(String token, String encodingAesKey, String componentAppid) {\n        this.token = token;\n        this.encodingAesKey = encodingAesKey;\n        this.componentAppid = componentAppid;\n    }\n\n    /**\n     * Decrypt WeChat message\n     *\n     * @param msgSignature Message signature\n     * @param timestamp Timestamp\n     * @param nonce Random number\n     * @param encryptData Encrypted data\n     * @return Decrypted message\n     */\n    public String decryptMessage(String msgSignature, String timestamp, String nonce, String encryptData) {\n        if (!StringUtils.hasText(encryptData)) {\n            throw new IllegalArgumentException(\"Encrypted data cannot be empty\");\n        }\n\n        try {\n            // TODO: Implement actual WeChat message decryption logic here\n            // In actual projects, should use the official WeChat WXBizMsgCrypt class\n            log.warn(\"WeChat message decryption functionality needs to be implemented, currently returning mock data\");\n\n            // Return mock decrypted data\n            return \"<xml>\" +\n                    \"<AppId><![CDATA[\" + componentAppid + \"]]></AppId>\" +\n                    \"<InfoType><![CDATA[authorized]]></InfoType>\" +\n                    \"<AuthorizerAppid><![CDATA[wx[example_appid]]]></AuthorizerAppid>\" +\n                    \"<AuthorizationCode><![CDATA[auth_code_123]]></AuthorizationCode>\" +\n                    \"<CreateTime>1234567890</CreateTime>\" +\n                    \"</xml>\";\n\n        } catch (Exception e) {\n            log.error(\"WeChat message decryption failed: msgSignature={}, timestamp={}, nonce={}\",","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WechatMessageCrypto.java#L20-L56","documentation":"WechatMessageCrypto.decryptMessage first guards that the encryptData parameter is non-blank; if it has no text it throws IllegalArgumentException('Encrypted data cannot be empty'). This is a fail-fast input validation: there is nothing to decrypt, and the stub implementation (which currently returns mock data) cannot proceed.","triggerScenarios":"Calling decryptMessage(msgSignature, timestamp, nonce, encryptData) with encryptData being null, empty string, or whitespace — e.g. the incoming request's encrypted payload parameter was missing or the <Encrypt> XML field was absent.","commonSituations":"WeChat callback configured in plaintext mode so no encrypted payload is sent; controller fails to extract the encrypted body/parameter before calling the service; a sender (or attacker/scanner) POSTs an empty callback to the endpoint.","solutions":["Check the caller extracts the encrypted payload (Encrypt request param or <Encrypt> XML field) and passes it through.","Ensure the WeChat console callback mode matches the expected encrypted mode.","Add an upstream check returning HTTP 400 for blank payloads instead of relying on this exception.","Note the class is a TODO stub: implement decryption via the official WXBizMsgCrypt (present in the same package) so real payloads decrypt correctly."],"exampleFix":"// before\ncrypto.decryptMessage(sig, ts, nonce, request.getParameter(\"encrypt\")); // may be null\n// after\nString enc = request.getParameter(\"encrypt\");\nif (enc == null || enc.isBlank()) {\n    return ResponseEntity.badRequest().build();\n}\ncrypto.decryptMessage(sig, ts, nonce, enc);","handlingStrategy":"validation","validationCode":"if (!StringUtils.hasText(encryptData)) { return ResponseEntity.badRequest().body(\"missing encrypted payload\"); }","typeGuard":null,"tryCatchPattern":"try { return crypto.decryptMessage(sig, ts, nonce, enc); } catch (IllegalArgumentException e) { return ResponseEntity.badRequest().body(\"encrypted data required\"); }","preventionTips":["Extract the Encrypt param/XML field before invoking crypto","Match the WeChat console encryption mode to your handler","Return 400 early for blank callback payloads","Replace the TODO stub with official WXBizMsgCrypt"],"tags":["wechat","input-validation","null-argument","empty-payload"],"backgroundTag":"empty-required-field","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}