{"record":{"id":"9deb7e6bc9e6eedb","repo":"MyCATApache/Mycat-Server","slug":"host-host-user-user-passwrod-need-to-decrype","errorCode":null,"errorMessage":"host {host},user {user} passwrod need to decrype ,but decrype password is wrong !","messagePattern":"host (.+?),user (.+?) passwrod need to decrype ,but decrype password is wrong !","errorType":"exception","errorClass":"ConfigException","httpStatus":null,"severity":"error","filePath":"src/main/java/io/mycat/util/DecryptUtil.java","lineNumber":111,"sourceCode":"\t\t\t}\n\t\t}\n\t\treturn passwrod;\n\t}\n\tpublic static String DBHostDecrypt(String usingDecrypt,String host,String user ,String passwrod){\n\t\tif(\"1\".equals(usingDecrypt)||\"true\".equalsIgnoreCase(usingDecrypt)){\n\t\t\t//type:host:user:password\n        \t//1:myhost1:test:test\n        \tboolean flag = false;\n        \ttry {\n        \t\tString passwrods[] = DecryptUtil.decrypt(passwrod).split(\":\");\n            \tif(\"1\".equals(passwrods[0]) && host.equals(passwrods[1]) && user.equals(passwrods[2])){\n            \t\treturn passwrods[3];\n            \t}\n            \tif(flag==false){\n            \t\t throw new ConfigException(\"user \" + user + \" passwrod need to decrype ,but decrype password is wrong !\");\n            \t}\n        \t} catch (Exception e2) {\n       \t\t    throw new ConfigException(\"host \" + host + \",user \" + user + \" passwrod need to decrype ,but decrype password is wrong !\",e2);\n\t\t\t}\n\t\t}\n\t\treturn passwrod;\n\t}\n\t\n\n\tpublic static String decrypt(String cipherText) throws Exception {\n\t\treturn decrypt((String) null, cipherText);\n\t}\n\n\tpublic static String decrypt(String publicKeyText, String cipherText)\n\t\t\tthrows Exception {\n\t\tPublicKey publicKey = getPublicKey(publicKeyText);\n\n\t\treturn decrypt(publicKey, cipherText);\n\t}\n\n\tpublic static PublicKey getPublicKey(String publicKeyText) {","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/MyCATApache/Mycat-Server/blob/65f8d8beb752f935752f2a0eec0ab017facab9ef/src/main/java/io/mycat/util/DecryptUtil.java#L93-L129","documentation":"DBHostDecrypt.decrypt() in Mycat's DecryptUtil parses user password strings of the form 'encrypted:user:password:host:index'. When the flag marker says the password should be decryptable but Base64/3DES decryption of the password segment fails (or throws any exception), it wraps the cause in a Mycat ConfigException naming the host and user.","triggerScenarios":"Calling DecryptUtil.decrypt() (directly or via datahost config loading) with a password string where the 4th segment is not a valid Base64-encoded 3DES ciphertext, or the encrypted blob was produced with a different key than the one DecryptUtil uses.","commonSituations":"Users hand-edit schema.xml/server.xml and paste a plain-text password where an encrypted one is expected; encrypted passwords copied between environments with different encryption keys; truncated Base64 from copy/paste; typo like 'passwrod' fields misused.","solutions":["Encrypt the password with Mycat's own encryption tool (DecryptUtil.encode / conf wrapper script) so the ciphertext matches the expected 3DES key and format","Verify the full credential string has all 5 colon-separated segments and the encrypted password is valid Base64 (length multiple of 4)","If you intend a plain-text password, generate the entry without encryption instead of pasting raw text into the encrypted field","Enable debug logging of the underlying exception (e2) to confirm whether it is BadPadding, IllegalBlockSize, or Base64 decode failure"],"exampleFix":"// before\n<property name=\"password\">myPlainPassword</property>\n// after\n<property name=\"password\">encryptedPasswordProducedByMycatEncodeTool</property>","handlingStrategy":"validation","validationCode":"static boolean isEncryptedEntry(String entry){\n    if(entry==null) return false;\n    String[] p = entry.split(\":\");\n    if(p.length < 5 || !\"encrypted\".equalsIgnoreCase(p[0])) return true; // plain text ok\n    try { java.util.Base64.getDecoder().decode(p[3]); return true; }\n    catch(IllegalArgumentException e){ return false; }\n}","typeGuard":null,"tryCatchPattern":"try { pwd = DecryptUtil.decrypt(entry); }\ncatch (ConfigException e) { LOG.error(\"bad encrypted password for host/user\", e); throw new IllegalArgumentException(\"re-encrypt password with Mycat tool\", e); }","preventionTips":["Always produce encrypted passwords with Mycat's bundled encode tool, never by hand","Keep the same encryption key across environments when copying configs","Check the credential string has all colon-separated segments before deployment","Test config loading in a staging node before rollout"],"tags":["java","encryption","configuration","base64"],"backgroundTag":"invalid-config-value","analyzedSha":"65f8d8beb752f935752f2a0eec0ab017facab9ef","analyzedAt":"2026-09-11T00:12:21.696Z","contentChangedAt":"2026-09-11T00:12:21.696Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}