{"record":{"id":"b5f43c106a1b4496","repo":"JeffreySu/WeiXinMPSDK","slug":"aes-gcm-netstandard2-1-netcoreapp3-1","errorCode":null,"errorMessage":"当前目标框架不提供 AES-GCM。请在 netstandard2.1、netcoreapp3.1 或更新目标中解密通知资源。","messagePattern":"当前目标框架不提供 AES-GCM。请在 netstandard2\\.1、netcoreapp3\\.1 或更新目标中解密通知资源。","errorType":"exception","errorClass":"PlatformNotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Senparc.Weixin.Work/Senparc.Weixin.Work/Entities/Request/Event/RequestMessageEvent_MiniProgramPay.cs","lineNumber":67,"sourceCode":"\n        /// <summary>资源类型。</summary>\n        public string resource_type { get; set; }\n\n        /// <summary>加密业务资源。</summary>\n        public MiniProgramPayNotificationResource resource { get; set; }\n\n        /// <summary>通知摘要。</summary>\n        public string summary { get; set; }\n\n        /// <summary>\n        /// 使用“对外收款”应用回调配置中的 EncodingAESKey 解密业务资源。\n        /// .NET Framework 与 netstandard2.0 不提供平台 AES-GCM 实现，将抛出\n        /// <see cref=\"PlatformNotSupportedException\"/>；这些目标仍可接收完整加密通知模型。\n        /// </summary>\n        public string DecryptResource(string encodingAesKey)\n        {\n#if NET462 || NETSTANDARD2_0\n            throw new PlatformNotSupportedException(\n                \"当前目标框架不提供 AES-GCM。请在 netstandard2.1、netcoreapp3.1 或更新目标中解密通知资源。\");\n#else\n            if (string.IsNullOrEmpty(encodingAesKey) || encodingAesKey.Length != 43)\n            {\n                throw new ArgumentException(\"EncodingAESKey 必须为 43 个字符。\", nameof(encodingAesKey));\n            }\n\n            if (resource == null)\n            {\n                throw new InvalidOperationException(\"通知中不包含 resource 节点。\");\n            }\n\n            if (!string.Equals(resource.algorithm, \"AEAD_AES_256_GCM\", StringComparison.OrdinalIgnoreCase))\n            {\n                throw new NotSupportedException($\"不支持的通知资源加密算法：{resource.algorithm}\");\n            }\n\n            var key = Convert.FromBase64String(encodingAesKey + \"=\");","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/JeffreySu/WeiXinMPSDK/blob/be573f6f94bdbf718dd5f6cdecb137fbc7ff651e/src/Senparc.Weixin.Work/Senparc.Weixin.Work/Entities/Request/Event/RequestMessageEvent_MiniProgramPay.cs#L49-L85","documentation":"DecryptResource is used to decrypt the encrypted `resource` node of a WeChat Work mini-program payment notification using AES-GCM. On .NET Framework 4.6.2 and netstandard2.0 targets the platform provides no AesGcm implementation, so the library deliberately throws PlatformNotSupportedException instead of attempting decryption. The full encrypted notification model can still be received; only decryption must happen on a newer target.","triggerScenarios":"Calling DecryptResource(encodingAesKey) on a RequestMessageEvent_MiniProgramPay when the consuming project targets net462 or netstandard2.0.","commonSituations":"Projects compiled against the .NET Framework or netstandard2.0 multi-target of the library trying to decrypt payment callbacks after upgrading the SDK; CI builds on an older TFM silently hitting the conditional-compilation branch.","solutions":["Retarget the consuming project to netstandard2.1, netcoreapp3.1, or a newer framework (net5/6/7+) where AesGcm is available","Keep the net462/netstandard2.0 build and decrypt the notification in a separate service running a modern runtime","Use a third-party AES-GCM implementation (e.g. BouncyCastle) and decrypt the ciphertext manually from resource.ciphertext instead of calling DecryptResource"],"exampleFix":"// before (csproj)\n<TargetFrameworks>net462;netstandard2.0</TargetFrameworks>\n// after\n<TargetFrameworks>net462;netstandard2.0;net6.0</TargetFrameworks>","handlingStrategy":"validation","validationCode":"#if NET462 || NETSTANDARD2_0\n#error DecryptResource requires netstandard2.1 or newer target\n#endif","typeGuard":"static bool SupportsAesGcm =>\n    !typeof(object).Assembly.GetName().Name.StartsWith(\"mono\") &&\n    Environment.Version >= new Version(3, 0);","tryCatchPattern":"try { var plain = msg.DecryptResource(aesKey); }\ncatch (PlatformNotSupportedException ex) { log.Warn(\"AES-GCM unsupported on this TFM\"); return FallbackDecrypt(msg, aesKey); }","preventionTips":["Pin the deployment runtime to netcoreapp3.1+/net5+ when handling encrypted payment notifications","Add a multi-target compile check so net462/netstandard2.0 builds cannot reference the decrypt path","Document per-TFM capabilities where the notification handler is registered"],"tags":["cryptography","aes-gcm","platform-not-supported","multi-targeting"],"backgroundTag":"unsupported-platform","analyzedSha":"be573f6f94bdbf718dd5f6cdecb137fbc7ff651e","analyzedAt":"2026-09-12T10:01:50.733Z","contentChangedAt":"2026-09-12T10:01:50.733Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}