{"record":{"id":"bbe80b4467559a17","repo":"chenhg5/cc-connect","slug":"invalid-ciphertext-length-d","errorCode":null,"errorMessage":"invalid ciphertext length %d","messagePattern":"invalid ciphertext length (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/wecom/wecom.go","lineNumber":761,"sourceCode":"}\n\n// decrypt decodes and decrypts a Base64-encoded AES-256-CBC ciphertext.\n// Layout after decryption + PKCS#7 unpad:\n//\n//\t[16 bytes random] [4 bytes msg_len (big-endian)] [msg_len bytes message] [corp_id]\nfunc (p *Platform) decrypt(cipherBase64 string) (string, error) {\n\tcipherData, err := base64.StdEncoding.DecodeString(cipherBase64)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"base64 decode: %w\", err)\n\t}\n\n\tblock, err := aes.NewCipher(p.aesKey)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"aes new cipher: %w\", err)\n\t}\n\n\tif len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {\n\t\treturn \"\", fmt.Errorf(\"invalid ciphertext length %d\", len(cipherData))\n\t}\n\n\tiv := p.aesKey[:16]\n\tmode := cipher.NewCBCDecrypter(block, iv)\n\tplain := make([]byte, len(cipherData))\n\tmode.CryptBlocks(plain, cipherData)\n\n\tplain = pkcs7Unpad(plain)\n\n\tif len(plain) < 20 {\n\t\treturn \"\", fmt.Errorf(\"decrypted data too short\")\n\t}\n\n\tmsgLen := int(binary.BigEndian.Uint32(plain[16:20]))\n\tif 20+msgLen > len(plain) {\n\t\treturn \"\", fmt.Errorf(\"invalid message length %d in decrypted data (total %d)\", msgLen, len(plain))\n\t}\n","sourceCodeStart":743,"sourceCodeEnd":779,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/wecom/wecom.go#L743-L779","documentation":"Structural guard on the decoded ciphertext in decrypt: its byte length is either below the AES block size (16) or not a multiple of it, so AES-256-CBC cannot process it. This means the Base64 input decoded to a malformed ciphertext — typically a truncated or tampered encrypt field rather than a WeCom-originated message.","triggerScenarios":"Thrown at platform/wecom/wecom.go:761 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the callback; do not retry — malformed ciphertext never self-heals","Check for body truncation by proxies or size limits on the callback endpoint","Verify the payload passed signature verification; forgeries often fail this length check"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}