{"record":{"id":"35b9fad471790dc8","repo":"fish2018/pansou","slug":"error-35b9fa","errorCode":null,"errorMessage":"数据为空","messagePattern":"数据为空","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugin/sdso/sdso.go","lineNumber":429,"sourceCode":"\tmode := cipher.NewCBCDecrypter(block, iv)\n\n\t// 解密\n\tplaintext := make([]byte, len(ciphertext))\n\tmode.CryptBlocks(plaintext, ciphertext)\n\n\t// 去除PKCS7填充\n\tunpaddedText, err := removePKCS7Padding(plaintext)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"去除填充失败: %w\", err)\n\t}\n\n\treturn string(unpaddedText), nil\n}\n\n// removePKCS7Padding 去除PKCS7填充\nfunc removePKCS7Padding(data []byte) ([]byte, error) {\n\tif len(data) == 0 {\n\t\treturn nil, fmt.Errorf(\"数据为空\")\n\t}\n\n\t// 获取填充长度\n\tpaddingLen := int(data[len(data)-1])\n\n\t// 验证填充长度\n\tif paddingLen == 0 || paddingLen > len(data) || paddingLen > aes.BlockSize {\n\t\treturn nil, fmt.Errorf(\"无效的填充长度: %d\", paddingLen)\n\t}\n\n\t// 验证填充字节\n\tfor i := len(data) - paddingLen; i < len(data); i++ {\n\t\tif data[i] != byte(paddingLen) {\n\t\t\treturn nil, fmt.Errorf(\"无效的填充字节\")\n\t\t}\n\t}\n\n\t// 返回去除填充后的数据","sourceCodeStart":411,"sourceCodeEnd":447,"githubUrl":"https://github.com/fish2018/pansou/blob/beaa56133755a548ebc51b090b3816e2ae044aa6/plugin/sdso/sdso.go#L411-L447","documentation":"removePKCS7Padding rejects an empty input slice with 数据为空 before inspecting the padding byte. Within DecryptURL's flow this is nearly unreachable because DecryptURL already rejects zero-length ciphertext, so seeing it means removePKCS7Padding was invoked with a nil/empty slice, or plaintext allocation produced zero bytes unexpectedly.","triggerScenarios":"Calling removePKCS7Padding directly with a nil or empty []byte; DecryptURL given ciphertext that decoded to zero bytes (though that path is guarded earlier by 密文长度为0).","commonSituations":"A developer unit-testing or reusing removePKCS7Padding passes an empty buffer; upstream data pipeline delivered an empty payload into the padding step.","solutions":["Guard with len(data) > 0 before calling removePKCS7Padding.","If calling DecryptURL, ensure the Base64 input is non-empty and decodes to at least 16 bytes.","Treat this as an input-validation bug in the caller rather than a crypto failure; add an early return/log for empty payloads."],"exampleFix":"// before\nout, err := removePKCS7Padding(data)\n// after\nif len(data) == 0 {\n    return nil, fmt.Errorf(\"skip: empty payload\")\n}\nout, err := removePKCS7Padding(data)","handlingStrategy":"validation","validationCode":"if len(data) == 0 {\n    return fmt.Errorf(\"refusing to unpad empty payload\")\n}\nout, err := removePKCS7Padding(data)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check for empty/nil byte slices before crypto post-processing.","Validate payloads at the pipeline boundary (non-empty, block-aligned).","Log and skip empty payloads instead of passing them to unpadding."],"tags":["crypto","pkcs7","validation","go"],"backgroundTag":"empty-required-field","analyzedSha":"beaa56133755a548ebc51b090b3816e2ae044aa6","analyzedAt":"2026-09-07T00:31:18.025Z","contentChangedAt":"2026-09-07T00:31:18.025Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}