{"record":{"id":"db985413a5d95899","repo":"paascloud/paascloud-master","slug":"uac10011031","errorCode":"UAC10011031","errorMessage":"UAC10011031","messagePattern":"UAC10011031","errorType":"error_code","errorClass":"UacBizException","httpStatus":null,"severity":"error","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/EmailServiceImpl.java","lineNumber":151,"sourceCode":"\t\tPreconditions.checkArgument(StringUtils.isNotEmpty(email), ErrorCodeEnum.UAC10011018.msg());\n\t\tPreconditions.checkArgument(StringUtils.isNotEmpty(emailCode), \"验证码不能为空\");\n\n\t\t// 解密用户名密码\n\t\temail = decryptEmail(loginName, email);\n\t\tString key = RedisKeyUtil.getSendEmailCodeKey(loginName, email);\n\t\tString emailCodeRedis = redisService.getKey(key);\n\t\tPreconditions.checkArgument(StringUtils.isNotEmpty(emailCodeRedis), \"验证码已过期\");\n\t\tPreconditions.checkArgument(StringUtils.equals(emailCode, emailCodeRedis), \"验证码错误\");\n\t}\n\n\tprivate String decryptEmail(final String loginName, String email) {\n\t\ttry {\n\t\t\temail = HttpAesUtil.decrypt(email, KEY_STR, false, IV_STR);\n\t\t\tlog.info(\"发送短信 解密loginName={}\", loginName);\n\t\t\tlog.info(\"发送短信 解密email={}\", email);\n\t\t} catch (Exception ex) {\n\t\t\tlog.info(\"发送短信 解密手机号码失败 密文loginName={}, email={}\", loginName, email);\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011031);\n\t\t}\n\t\treturn email;\n\t}\n}\n","sourceCodeStart":133,"sourceCodeEnd":156,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/EmailServiceImpl.java#L133-L156","documentation":"EmailServiceImpl.decryptEmail throws UacBizException(UAC10011031) when HttpAesUtil.decrypt(email, KEY_STR, false, IV_STR) throws while decrypting the AES-encrypted email parameter. The private helper (called by sendEmailCode and checkEmailCode) logs the failure with the ciphertext and rethrows, so malformed or tampered encrypted email input is rejected before any lookup.","triggerScenarios":"Calling sendEmailCode or checkEmailCode with an email value that is not valid AES ciphertext for the configured KEY_STR/IV_STR — e.g. plaintext email passed in, wrong padding, or encrypted with a different key.","commonSituations":"Frontend encryption key/config (KEY_STR, IV_STR) mismatched between client and server; client sending the email already URL-decoded or as plaintext; older app versions encrypting with a legacy key; manual API testing with a raw email string.","solutions":["Encrypt the email on the client with the same KEY_STR/IV_STR the server uses (same AES mode/padding)","Test decryption locally: HttpAesUtil.decrypt(sampleCiphertext, KEY_STR, false, IV_STR)","Ensure the ciphertext survives transport intact (URL-encode when in query strings)","Align key config across environments — check the encryption key property in config center vs frontend build"],"exampleFix":"// before\nPOST /email/code?email=test@example.com            // plaintext, not AES-encrypted\n// after\nString cipher = HttpAesUtil.encrypt(\"test@example.com\", KEY_STR, false, IV_STR);\nPOST /email/code?email=\" + URLEncoder.encode(cipher, \"UTF-8\");","handlingStrategy":"validation","validationCode":"boolean decodable;\ntry { HttpAesUtil.decrypt(emailParam, KEY_STR, false, IV_STR); decodable = true; } catch (Exception e) { decodable = false; }\nif (!decodable) { /* re-encrypt with the correct key before calling the API */ }","typeGuard":null,"tryCatchPattern":"try { emailService.sendEmailCode(loginName, encryptedEmail); } catch (UacBizException e) { if (ErrorCodeEnum.UAC10011031.getCode().equals(e.getCode())) { reEncryptAndRetry(); } throw e; }","preventionTips":["Share KEY_STR/IV_STR through config center and the frontend build from one source","URL-encode AES ciphertext in query strings to protect +, /, = characters","Add an integration test that encrypts on the client path and decrypts via decryptEmail","Version the encryption scheme so old clients can be handled during key rotation"],"tags":["aes","encryption","decryption","input-validation"],"backgroundTag":"decryption-failed","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}