{"record":{"id":"8ee8c906b15329ad","repo":"iflytek/astron-agent","slug":"40003-sha-encryption-signature-generation-failed","errorCode":"-40003","errorMessage":"SHA encryption signature generation failed","messagePattern":"SHA encryption signature generation failed","errorType":"error_code","errorClass":"AesException","httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java","lineNumber":297,"sourceCode":"            String str = sb.toString();\n            // SHA1 signature generation\n            MessageDigest md = MessageDigest.getInstance(\"SHA-1\");\n            md.update(str.getBytes(CHARSET));\n            byte[] digest = md.digest();\n\n            StringBuilder hexstr = new StringBuilder();\n            String shaHex = \"\";\n            for (int i = 0; i < digest.length; i++) {\n                shaHex = Integer.toHexString(digest[i] & 0xFF);\n                if (shaHex.length() < 2) {\n                    hexstr.append(0);\n                }\n                hexstr.append(shaHex);\n            }\n            return hexstr.toString();\n        } catch (Exception e) {\n            e.printStackTrace();\n            throw new AesException(AesException.ComputeSignatureError);\n        }\n    }\n\n    /**\n     * Byte group utility class\n     */\n    static class ByteGroup {\n        java.util.ArrayList<Byte> byteContainer = new java.util.ArrayList<Byte>();\n\n        public byte[] toBytes() {\n            byte[] bytes = new byte[byteContainer.size()];\n            for (int i = 0; i < byteContainer.size(); i++) {\n                bytes[i] = byteContainer.get(i);\n            }\n            return bytes;\n        }\n\n        public void addBytes(byte[] bytes) {","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java#L279-L315","documentation":"getSHA1 builds the WeChat callback signature by SHA-1 hashing the sorted concatenation of token, timestamp, nonce and encrypt content. If any exception occurs during message-digest computation or hex conversion it throws AesException -40003 (ComputeSignatureError) after printing the stack trace.","triggerScenarios":"Calling getSHA1 (directly or via verifyUrl/decryptMsg/signature) when MessageDigest.getInstance(\"SHA-1\") fails, a digest/update/digest call throws, or an input is null causing an unexpected exception inside the try block.","commonSituations":"Null token/timestamp/nonce/encrypt arguments reaching the method (e.g. missing query parameters bound as null); a JCE provider problem or restricted JDK environment lacking SHA-1; corrupted build/deployment of the crypto utility.","solutions":["Validate that token, timeStamp, nonce and encrypt are non-null, non-empty strings before calling getSHA1.","Check the JDK/JCE provider supports SHA-1 (virtually all do) and that no custom Security provider removes it.","Read the printed stack trace (e.printStackTrace) to identify the exact underlying exception.","Replace printStackTrace with proper logging and rethrow context in production."],"exampleFix":"// before\nwxCrypt.getSHA1(token, timestamp, nonce, encrypt); // timestamp may be null\n// after\nif (token == null || timestamp == null || nonce == null || encrypt == null) {\n    throw new IllegalArgumentException(\"signature inputs required\");\n}\nwxCrypt.getSHA1(token, timestamp, nonce, encrypt);","handlingStrategy":"validation","validationCode":"boolean ok = token != null && timestamp != null && nonce != null && encrypt != null;\nif (!ok) throw new IllegalArgumentException(\"all four signature inputs are required\");","typeGuard":null,"tryCatchPattern":"try { return crypto.getSHA1(token, ts, nonce, enc); } catch (AesException e) { if (e.getCode() == -40003) { log.error(\"SHA-1 computation failed\", e); throw new IllegalStateException(\"signature computation unavailable\", e); } throw e; }","preventionTips":["Null-check all signature inputs before hashing","Verify JDK/JCE supports SHA-1 after upgrades","Replace printStackTrace with structured logging","Cover getSHA1 with unit tests using known WeChat vectors"],"tags":["wechat","sha1","signature","crypto"],"backgroundTag":"checksum-mismatch","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}