{"record":{"id":"c84e88cd5a372bdb","repo":"chenhg5/cc-connect","slug":"base64-decode-w","errorCode":null,"errorMessage":"base64 decode: %w","messagePattern":"base64 decode: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/wecom/wecom.go","lineNumber":752,"sourceCode":"\treturn got == expected\n}\n\n// decodeAESKey converts the 43-char Base64 EncodingAESKey to 32 bytes.\nfunc decodeAESKey(encodingAESKey string) ([]byte, error) {\n\tif len(encodingAESKey) != 43 {\n\t\treturn nil, fmt.Errorf(\"EncodingAESKey must be 43 characters, got %d\", len(encodingAESKey))\n\t}\n\treturn base64.StdEncoding.DecodeString(encodingAESKey + \"=\")\n}\n\n// decrypt decodes and decrypts a Base64-encoded AES-256-CBC ciphertext.\n// Layout after decryption + PKCS#7 unpad:\n//\n//\t[16 bytes random] [4 bytes msg_len (big-endian)] [msg_len bytes message] [corp_id]\nfunc (p *Platform) decrypt(cipherBase64 string) (string, error) {\n\tcipherData, err := base64.StdEncoding.DecodeString(cipherBase64)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"base64 decode: %w\", err)\n\t}\n\n\tblock, err := aes.NewCipher(p.aesKey)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"aes new cipher: %w\", err)\n\t}\n\n\tif len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {\n\t\treturn \"\", fmt.Errorf(\"invalid ciphertext length %d\", len(cipherData))\n\t}\n\n\tiv := p.aesKey[:16]\n\tmode := cipher.NewCBCDecrypter(block, iv)\n\tplain := make([]byte, len(cipherData))\n\tmode.CryptBlocks(plain, cipherData)\n\n\tplain = pkcs7Unpad(plain)\n","sourceCodeStart":734,"sourceCodeEnd":770,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/wecom/wecom.go#L734-L770","documentation":"Base64 decode failure on the encrypt field of an inbound WeCom callback: the ciphertext string submitted by the caller (or the signature-verified payload) is not valid standard Base64, so AES decryption cannot even start. Usually a truncated or URL-mangled payload, or a callback not originating from WeCom.","triggerScenarios":"Thrown at platform/wecom/wecom.go:752 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reject the callback with an error response rather than retrying — the payload is corrupted","Verify no intermediary (proxy/gateway) re-encodes or truncates the POST body","Confirm signature verification passed first; unsigned foreign requests naturally fail here"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}