{"record":{"id":"4d8bf7220daba8da","repo":"chenhg5/cc-connect","slug":"decrypted-data-too-short","errorCode":null,"errorMessage":"decrypted data too short","messagePattern":"decrypted data too short","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/wecom/wecom.go","lineNumber":772,"sourceCode":"\n\tblock, err := aes.NewCipher(p.aesKey)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"aes new cipher: %w\", err)\n\t}\n\n\tif len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {\n\t\treturn \"\", fmt.Errorf(\"invalid ciphertext length %d\", len(cipherData))\n\t}\n\n\tiv := p.aesKey[:16]\n\tmode := cipher.NewCBCDecrypter(block, iv)\n\tplain := make([]byte, len(cipherData))\n\tmode.CryptBlocks(plain, cipherData)\n\n\tplain = pkcs7Unpad(plain)\n\n\tif len(plain) < 20 {\n\t\treturn \"\", fmt.Errorf(\"decrypted data too short\")\n\t}\n\n\tmsgLen := int(binary.BigEndian.Uint32(plain[16:20]))\n\tif 20+msgLen > len(plain) {\n\t\treturn \"\", fmt.Errorf(\"invalid message length %d in decrypted data (total %d)\", msgLen, len(plain))\n\t}\n\n\tmsg := string(plain[20 : 20+msgLen])\n\tcorpID := string(plain[20+msgLen:])\n\n\tif corpID != p.corpID {\n\t\treturn \"\", fmt.Errorf(\"corp_id mismatch: expected %s, got %s\", p.corpID, corpID)\n\t}\n\n\treturn msg, nil\n}\n\nfunc pkcs7Unpad(data []byte) []byte {","sourceCodeStart":754,"sourceCodeEnd":790,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/wecom/wecom.go#L754-L790","documentation":"Post-decryption sanity guard: after AES-CBC decryption and PKCS#7 unpadding, the plaintext is shorter than the minimum 20 bytes needed for WeCom's layout (16-byte random prefix + 4-byte big-endian message length). A payload this small cannot be a legitimate WeCom-encrypted message, indicating a wrong key or corrupted ciphertext that nonetheless decrypted.","triggerScenarios":"Thrown at platform/wecom/wecom.go:772 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["First suspect the EncodingAESKey: a wrong-but-valid-length key decrypts to garbage that fails this check","Compare the key against the WeCom admin console for the same app","Reject the callback; retries cannot fix a key mismatch"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}