{"record":{"id":"3cde326b1ba6c4d3","repo":"fish2018/pansou","slug":"aes-w","errorCode":null,"errorMessage":"创建AES加密器失败: %w","messagePattern":"创建AES加密器失败: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"plugin/sdso/sdso.go","lineNumber":402,"sourceCode":"\tciphertext, err := base64.StdEncoding.DecodeString(encryptedURL)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"Base64解码失败: %w\", err)\n\t}\n\n\t// 检查密文长度\n\tif len(ciphertext) == 0 {\n\t\treturn \"\", fmt.Errorf(\"密文长度为0\")\n\t}\n\n\t// 检查密文长度是否为16的倍数\n\tif len(ciphertext)%aes.BlockSize != 0 {\n\t\treturn \"\", fmt.Errorf(\"密文长度不是AES块大小的倍数\")\n\t}\n\n\t// 创建AES块加密器\n\tblock, err := aes.NewCipher([]byte(AESKey))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"创建AES加密器失败: %w\", err)\n\t}\n\n\t// 创建CBC模式解密器\n\tiv := []byte(AESIV)\n\tif len(iv) != aes.BlockSize {\n\t\treturn \"\", fmt.Errorf(\"IV长度不正确: 期望%d，实际%d\", aes.BlockSize, len(iv))\n\t}\n\n\tmode := cipher.NewCBCDecrypter(block, iv)\n\n\t// 解密\n\tplaintext := make([]byte, len(ciphertext))\n\tmode.CryptBlocks(plaintext, ciphertext)\n\n\t// 去除PKCS7填充\n\tunpaddedText, err := removePKCS7Padding(plaintext)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"去除填充失败: %w\", err)","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/fish2018/pansou/blob/beaa56133755a548ebc51b090b3816e2ae044aa6/plugin/sdso/sdso.go#L384-L420","documentation":"DecryptURL builds an AES block cipher from the package-level AESKey via aes.NewCipher. Go's crypto/aes only accepts 16, 24, or 32-byte keys; any other key length makes NewCipher fail, and the error is wrapped as 创建AES加密器失败. This indicates the configured key constant is not a valid AES key size.","triggerScenarios":"AESKey is set to a string whose byte length is not 16/24/32 — e.g. a short placeholder, a hex-encoded key pasted as raw text, or a config value read from environment/config that is empty or the wrong length.","commonSituations":"Developer replaced the default key with a custom one that is e.g. 20 characters; key loaded from env var left empty; key stored hex/base64-encoded but passed without decoding.","solutions":["Print/measure len([]byte(AESKey)) and make it exactly 16, 24, or 32 bytes.","If the key is stored hex- or base64-encoded, decode it before assigning AESKey.","Restore the default SDSO AESKey known to work with the site if a custom key was introduced.","Add a package init check that fails fast when len(AESKey) not in {16,24,32}."],"exampleFix":"// before\nconst AESKey = \"my-secret-key\"\n// after\n// key must be exactly 16/24/32 bytes\nconst AESKey = \"0123456789abcdef\" // 16 bytes","handlingStrategy":"validation","validationCode":"key := []byte(AESKey)\nif n := len(key); n != 16 && n != 24 && n != 32 {\n    return fmt.Errorf(\"AESKey must be 16/24/32 bytes, got %d\", n)\n}","typeGuard":"func hasValidAESKeySize(key []byte) bool {\n    return len(key) == 16 || len(key) == 24 || len(key) == 32\n}","tryCatchPattern":null,"preventionTips":["Assert key length at package init or in a unit test, not at first decrypt.","Decode hex/base64-encoded keys before assigning them as raw key bytes.","Document the required key sizes next to the AESKey constant.","Fail fast at startup for any config-driven key."],"tags":["crypto","aes","config","go"],"backgroundTag":"invalid-config-value","analyzedSha":"beaa56133755a548ebc51b090b3816e2ae044aa6","analyzedAt":"2026-09-07T00:31:18.025Z","contentChangedAt":"2026-09-07T00:31:18.025Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}