{"record":{"id":"9524fdde27b17d87","repo":"chenhg5/cc-connect","slug":"s-aes-key-must-be-16-raw-bytes-or-32-char-hex-b","errorCode":null,"errorMessage":"%s: aes_key must be 16 raw bytes or 32-char hex (base64-wrapped), got %d bytes after base64","messagePattern":"(.+?): aes_key must be 16 raw bytes or 32-char hex \\(base64-wrapped\\), got (.+?) bytes after base64","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/weixin/cdn.go","lineNumber":109,"sourceCode":"func parseAesKey(aesKeyBase64, label string) ([]byte, error) {\n\tdecoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(aesKeyBase64))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: aes_key base64: %w\", label, err)\n\t}\n\tif len(decoded) == 16 {\n\t\treturn decoded, nil\n\t}\n\tif len(decoded) == 32 {\n\t\ts := string(decoded)\n\t\tif hex32RE.MatchString(s) {\n\t\t\tk, err := hex.DecodeString(s)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"%s: aes_key hex inside base64: %w\", label, err)\n\t\t\t}\n\t\t\treturn k, nil\n\t\t}\n\t}\n\treturn nil, fmt.Errorf(\"%s: aes_key must be 16 raw bytes or 32-char hex (base64-wrapped), got %d bytes after base64\", label, len(decoded))\n}\n\nfunc buildCdnDownloadURL(encryptedQueryParam, cdnBase string) string {\n\treturn fmt.Sprintf(\"%s/download?encrypted_query_param=%s\",\n\t\tstrings.TrimRight(cdnBase, \"/\"),\n\t\turl.QueryEscape(encryptedQueryParam))\n}\n\nfunc buildCdnUploadURL(cdnBase, uploadParam, filekey string) string {\n\treturn fmt.Sprintf(\"%s/upload?encrypted_query_param=%s&filekey=%s\",\n\t\tstrings.TrimRight(cdnBase, \"/\"),\n\t\turl.QueryEscape(uploadParam),\n\t\turl.QueryEscape(filekey))\n}\n\nfunc fetchCdnBytes(ctx context.Context, client *http.Client, fullURL, label string) ([]byte, error) {\n\tif client == nil {\n\t\tclient = http.DefaultClient","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/weixin/cdn.go#L91-L127","documentation":"parseAesKey received a CDNMedia aes_key whose base64-decoded length is neither 16 raw bytes nor 32 bytes of hex ASCII — i.e. the key format is not one of the two layouts Weixin produces, so the media AES key cannot be derived for decrypting the CDN download.","triggerScenarios":"Thrown at platform/weixin/cdn.go:109 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Log the offending byte length and label to identify which message/media produced the malformed key","Verify the aes_key was not truncated or re-encoded in transit (double base64, URL-escaped)","Handle the failure by skipping the affected media and notifying rather than dropping the whole message"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}