{"record":{"id":"b82cc691ab9e5ccf","repo":"chenhg5/cc-connect","slug":"wecom-ws-decode-aeskey-w","errorCode":null,"errorMessage":"wecom-ws: decode aeskey: %w","messagePattern":"wecom-ws: decode aeskey: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/wecom/websocket_media.go","lineNumber":248,"sourceCode":"\t}\n\n\t// URL-safe alphabet → standard (RFC 4648 §5)\n\ts = strings.ReplaceAll(s, \"-\", \"+\")\n\ts = strings.ReplaceAll(s, \"_\", \"/\")\n\n\tswitch len(s) % 4 {\n\tcase 0:\n\tcase 2:\n\t\ts += \"==\"\n\tcase 3:\n\t\ts += \"=\"\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"wecom-ws: invalid aeskey base64 length\")\n\t}\n\n\tkey, err := base64.StdEncoding.DecodeString(s)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"wecom-ws: decode aeskey: %w\", err)\n\t}\n\tif len(key) < 32 {\n\t\treturn nil, fmt.Errorf(\"wecom-ws: aeskey decoded length %d, need >= 32\", len(key))\n\t}\n\treturn key, nil\n}\n\nfunc isHexString(s string) bool {\n\tfor i := 0; i < len(s); i++ {\n\t\tc := s[i]\n\t\tswitch {\n\t\tcase c >= '0' && c <= '9', c >= 'a' && c <= 'f', c >= 'A' && c <= 'F':\n\t\tdefault:\n\t\t\treturn false\n\t\t}\n\t}\n\treturn true\n}","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/wecom/websocket_media.go#L230-L266","documentation":"After normalizing padding, decodeWeComAESKey decodes the key with base64.StdEncoding and wraps any decode failure with this error. It means the string is not valid standard base64 even though its length was plausible — it contains characters outside the base64 alphabet or malformed padding. The original stdlib error is preserved via %w for inspection.","triggerScenarios":"wecomDecryptFile called with aesKeyB64 containing invalid characters (spaces, '-', '_' from URL-safe encoding without conversion, unicode, or '=' in the middle of the string).","commonSituations":"WeCom keys pasted from URLs where '+/' were replaced by '-_'; config file values with embedded spaces or quotes; key accidentally URL-encoded ('%2B' etc.); trimming left a trailing newline encoded oddly.","solutions":["Inspect errors.Is/As on the wrapped stdlib base64.CorruptInputError to find the offending byte offset.","Convert URL-safe base64 to standard: strings.NewReplacer('-','+','_','/').Replace(key) before decoding.","Re-export the EncodingAESKey from the WeCom admin console and paste it unmodified (43/44 char base64)."],"exampleFix":"// before\nplain, err := wecomDecryptFile(ct, urlSafeKey) // contains '-' or '_'\n// after\nstd := strings.NewReplacer(\"-\", \"+\", \"_\", \"/\").Replace(strings.TrimSpace(urlSafeKey))\nplain, err := wecomDecryptFile(ct, std)","handlingStrategy":"validation","validationCode":"func canDecodeBase64(s string) bool {\n    _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(s))\n    return err == nil\n}","typeGuard":null,"tryCatchPattern":"if _, err := wecomDecryptFile(ct, key); err != nil {\n    var cie base64.CorruptInputError\n    if errors.As(err, &cie) { log.Printf(\"bad base64 at offset %d\", int64(cie)) }\n}","preventionTips":["Convert URL-safe '-_' to '+/' before storing the key.","Validate the key decodes cleanly in a startup health check.","Avoid URL-encoding config values in TOML/environment plumbing."],"tags":["wecom","base64","crypto","decoding"],"backgroundTag":"invalid-argument-format","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}