{"record":{"id":"7878c06976e73ff6","repo":"fish2018/pansou","slug":"d-7878c0","errorCode":null,"errorMessage":"无效的填充长度: %d","messagePattern":"无效的填充长度: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/sdso/sdso.go","lineNumber":437,"sourceCode":"\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"去除填充失败: %w\", err)\n\t}\n\n\treturn string(unpaddedText), nil\n}\n\n// removePKCS7Padding 去除PKCS7填充\nfunc removePKCS7Padding(data []byte) ([]byte, error) {\n\tif len(data) == 0 {\n\t\treturn nil, fmt.Errorf(\"数据为空\")\n\t}\n\n\t// 获取填充长度\n\tpaddingLen := int(data[len(data)-1])\n\n\t// 验证填充长度\n\tif paddingLen == 0 || paddingLen > len(data) || paddingLen > aes.BlockSize {\n\t\treturn nil, fmt.Errorf(\"无效的填充长度: %d\", paddingLen)\n\t}\n\n\t// 验证填充字节\n\tfor i := len(data) - paddingLen; i < len(data); i++ {\n\t\tif data[i] != byte(paddingLen) {\n\t\t\treturn nil, fmt.Errorf(\"无效的填充字节\")\n\t\t}\n\t}\n\n\t// 返回去除填充后的数据\n\treturn data[:len(data)-paddingLen], nil\n}\n\n// cleanHTMLTags 清理HTML标签\nfunc cleanHTMLTags(text string) string {\n\t// 移除高亮标签 <span style=\"color: red;\">...</span>\n\tre := regexp.MustCompile(`<span[^>]*>(.*?)</span>`)\n\tcleaned := re.ReplaceAllString(text, \"$1\")","sourceCodeStart":419,"sourceCodeEnd":455,"githubUrl":"https://github.com/fish2018/pansou/blob/beaa56133755a548ebc51b090b3816e2ae044aa6/plugin/sdso/sdso.go#L419-L455","documentation":"removePKCS7Padding reads the last plaintext byte as the padding length and validates it is in [1, min(len(data), aes.BlockSize)]. If the value is 0, larger than the data, or larger than one AES block, the padding is structurally invalid and the function fails with 无效的填充长度. This is a strong signal that decryption produced garbage — typically a wrong AES key/IV.","triggerScenarios":"Decryption with mismatched AESKey/AESIV yields random-looking bytes whose last byte is an implausible padding length; ciphertext was corrupted in transit; input encrypted with a padding scheme other than PKCS7 (e.g. zero padding or no padding).","commonSituations":"SDSO site rotated keys so old constants decrypt to noise; cached encrypted URL from an older format; ciphertext passed through a transformation (URL decoding, charset conversion) that altered bytes.","solutions":["Verify AESKey/AESIV are current for the SDSO site; wrong-key garbage decryption is the dominant cause.","Re-fetch a fresh encrypted URL rather than decrypting cached/stale data.","Hex-dump the decrypted plaintext and confirm the last byte looks like padding (a small 1..16 value); if random, fix the key/IV, not the padding logic.","Confirm the upstream scheme is actually AES-CBC + PKCS7; if the site switched modes (e.g. GCM or no padding), update DecryptURL accordingly."],"exampleFix":"// before\nplaintext := make([]byte, len(ciphertext))\nmode.CryptBlocks(plaintext, ciphertext)\nunpaddedText, err := removePKCS7Padding(plaintext)\n// after\nplaintext := make([]byte, len(ciphertext))\nmode.CryptBlocks(plaintext, ciphertext)\nlast := int(plaintext[len(plaintext)-1])\nif last == 0 || last > aes.BlockSize || last > len(plaintext) {\n    return \"\", fmt.Errorf(\"decryption produced invalid padding %d — likely wrong AESKey/AESIV\", last)\n}\nunpaddedText, err := removePKCS7Padding(plaintext)","handlingStrategy":"validation","validationCode":"if len(plain) > 0 {\n    p := int(plain[len(plain)-1])\n    if p == 0 || p > 16 || p > len(plain) {\n        return fmt.Errorf(\"invalid padding length %d — likely wrong key/IV\", p)\n    }\n}","typeGuard":null,"tryCatchPattern":"plain, err := DecryptURL(enc)\nif err != nil {\n    if strings.Contains(err.Error(), \"无效的填充长度\") {\n        return refreshKeyAndRetry(enc) // reload current site key/IV\n    }\n    return err\n}","preventionTips":["Verify key/IV currency whenever padding errors appear.","Don't cache encrypted tokens across site key rotations.","Pre-check the last plaintext byte looks like valid padding length (1..16).","Confirm the upstream padding scheme before writing custom unpadding."],"tags":["crypto","aes","pkcs7","go"],"backgroundTag":"padding-validation-failed","analyzedSha":"beaa56133755a548ebc51b090b3816e2ae044aa6","analyzedAt":"2026-09-07T00:31:18.025Z","contentChangedAt":"2026-09-07T00:31:18.025Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}