{"record":{"id":"35c6b0272d90e859","repo":"OpenNHP/opennhp","slug":"invalid-e-w","errorCode":null,"errorMessage":"invalid e: %w","messagePattern":"invalid e: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/server/kbs/attest/attest.go","lineNumber":113,"sourceCode":"\n\tc.JSON(http.StatusOK, gin.H{\n\t\t\"token\": token,\n\t})\n}\n\nfunc parseTeePubkey(pubkey TeePubkey) (*rsa.PublicKey, error) {\n\tif pubkey.Kty != \"RSA\" {\n\t\treturn nil, errors.New(\"unsupported key type, expect RSA\")\n\t}\n\n\tnBytes, err := base64.RawURLEncoding.DecodeString(pubkey.N)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid n: %w\", err)\n\t}\n\n\teBytes, err := base64.RawURLEncoding.DecodeString(pubkey.E)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid e: %w\", err)\n\t}\n\n\te := 0\n\tfor _, b := range eBytes {\n\t\te = e<<8 | int(b)\n\t}\n\n\treturn &rsa.PublicKey{\n\t\tN: new(big.Int).SetBytes(nBytes),\n\t\tE: e,\n\t}, nil\n}\n\nfunc generateJWT() (string, error) {\n\tif jwtSigningKey == nil {\n\t\treturn \"\", errors.New(\"JWT signing key is not initialized\")\n\t}\n","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/attest/attest.go#L95-L131","documentation":"parseTeePubkey decodes the RSA exponent field pubkey.E with base64.RawURLEncoding. This error is returned when E is not valid unpadded base64url, so the exponent cannot be decoded. The underlying decode error is wrapped in 'invalid e: %w'.","triggerScenarios":"Attest receives a TEK pubkey whose e field is malformed base64url (padding, '+', '/', whitespace) or is empty, causing RawURLEncoding.DecodeString to fail.","commonSituations":"Client serializes e as the decimal string \"65537\" instead of base64url \"AQAB\"; padded base64 output; empty string for e; key produced by a library using standard base64.","solutions":["Fix the client to encode e as unpadded base64url (e.g. \"AQAB\" for 65537)","Trim '=' padding before decoding, as with n","Accept both decimal and base64url forms by trying strconv.Atoi first, then RawURLEncoding","Validate e client-side before sending and return a descriptive error to the caller"],"exampleFix":"// before\neBytes, err := base64.RawURLEncoding.DecodeString(pubkey.E)\nif err != nil {\n\treturn nil, fmt.Errorf(\"invalid e: %w\", err)\n}\n// after\neBytes, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(pubkey.E, \"=\"))\nif err != nil {\n\treturn nil, fmt.Errorf(\"invalid e (expect unpadded base64url, e.g. \\\"AQAB\\\"): %w\", err)\n}","handlingStrategy":"validation","validationCode":"if pubkey.E == \"\" {\n\treturn fmt.Errorf(\"missing exponent\")\n}\nif _, err := base64.RawURLEncoding.DecodeString(pubkey.E); err != nil {\n\treturn fmt.Errorf(\"e is not unpadded base64url\")\n}","typeGuard":"func isValidRawURLBase64(s string) bool {\n\t_, err := base64.RawURLEncoding.DecodeString(s)\n\treturn err == nil && s != \"\"\n}","tryCatchPattern":"pubkey, err := parseTeePubkey(body)\nif err != nil {\n\tif strings.HasPrefix(err.Error(), \"invalid e\") {\n\t\thttp.Error(w, \"malformed exponent (expect base64url like \\\"AQAB\\\")\", http.StatusBadRequest)\n\t\treturn\n\t}\n\treturn err\n}","preventionTips":["Use \"AQAB\" (base64url) for the standard exponent 65537","Avoid sending e as a decimal string","Strip '=' padding before decoding when interoperating with lenient clients","Share one JWK encoder library between client and server"],"tags":["go","base64","jwk","attestation"],"backgroundTag":"invalid-argument-format","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}