{"record":{"id":"dbb48f2fbbbb3c6c","repo":"paascloud/paascloud-master","slug":"error-dbb48f","errorCode":null,"errorMessage":"解密失败","messagePattern":"解密失败","errorType":"exception","errorClass":"HttpAesException","httpStatus":null,"severity":"error","filePath":"paascloud-common/paascloud-common-util/src/main/java/com/paascloud/HttpAesUtil.java","lineNumber":104,"sourceCode":"\t\t\tbyte[] content = new BASE64Decoder().decodeBuffer(contentParam);\n\t\t\tbyte[] key = keyParam.getBytes(CHAR_SET);\n\t\t\tbyte[] iv = ivParam.getBytes(CHAR_SET);\n\n\t\t\tif (md5Key) {\n\t\t\t\tMessageDigest md = MessageDigest.getInstance(\"MD5\");\n\t\t\t\tkey = md.digest(key);\n\t\t\t}\n\t\t\tSecretKeySpec skeySpec = new SecretKeySpec(key, \"AES\");\n\t\t\t//\"算法/模式/补码方式\"\n\t\t\tCipher cipher = Cipher.getInstance(\"AES/CBC/ISO10126Padding\");\n\t\t\t//使用CBC模式, 需要一个向量iv, 可增加加密算法的强度\n\t\t\tIvParameterSpec ivps = new IvParameterSpec(iv);\n\t\t\tcipher.init(Cipher.DECRYPT_MODE, skeySpec, ivps);\n\t\t\tbyte[] bytes = cipher.doFinal(content);\n\t\t\treturn new String(bytes, CHAR_SET);\n\t\t} catch (Exception ex) {\n\t\t\tlog.error(\"解密密码失败\", ex);\n\t\t\tthrow new HttpAesException(\"解密失败\");\n\t\t}\n\t}\n}","sourceCodeStart":86,"sourceCodeEnd":107,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-common/paascloud-common-util/src/main/java/com/paascloud/HttpAesUtil.java#L86-L107","documentation":"HttpAesUtil.decrypt throws HttpAesException('解密失败') when the underlying JCE Cipher fails to decrypt the given content with the provided AES key and IV. Any exception from cipher.doFinal (wrong key, corrupted or non-padded ciphertext, bad IV) is caught, logged as '解密密码失败', and rethrown with this generic message. The original cause is not attached, so check the log for '解密密码失败' to see the real reason.","triggerScenarios":"Calling HttpAesUtil.decrypt(content, key) with ciphertext encrypted using a different key, a wrong Base64/string encoding, a mismatched IV, or content truncated/tampered in transit. Also thrown when the key string length is not a valid AES size for the encrypted data.","commonSituations":"Client and server using different AES keys after a key rotation; data encrypted with AES/CBC but decrypted assuming another padding; ciphertext passed through URL encoding or JSON escaping that altered it; wrong charset conversion corrupting the Base64 payload.","solutions":["Verify the decrypt key is byte-for-byte identical to the key used for encryption (check config/env on both sides).","Confirm the ciphertext was not altered by transport (URL-decode/unescape it before decrypting).","Ensure the same transformation (AES/CBC/PKCS5Padding) and IV are used on both encrypt and decrypt sides.","Catch HttpAesException and log the '解密密码失败' stack trace to identify the underlying BadPaddingException/IllegalBlockSizeException.","Validate key length is 16/24/32 bytes for AES-128/192/256."],"exampleFix":"// before\nString plain = HttpAesUtil.decrypt(cipherText, key);\n// after\nString plain;\ntry {\n    plain = HttpAesUtil.decrypt(cipherText, key);\n} catch (HttpAesException e) {\n    log.error(\"AES decrypt failed, check key/IV/ciphertext\", e);\n    throw new BadRequestException(\"Invalid encrypted payload\");\n}","handlingStrategy":"try-catch","validationCode":"if (cipherText == null || cipherText.trim().isEmpty()) { throw new IllegalArgumentException(\"empty ciphertext\"); }\nif (key == null || !(key.length()==16||key.length()==24||key.length()==32)) { throw new IllegalArgumentException(\"invalid AES key length\"); }","typeGuard":null,"tryCatchPattern":"try {\n    String plain = HttpAesUtil.decrypt(cipherText, key);\n} catch (HttpAesException e) {\n    log.error(\"AES decrypt failed for payload\", e);\n    throw new BadRequestException(\"Invalid encrypted payload\");\n}","preventionTips":["Keep encrypt/decrypt keys, transformation and IV in one shared config.","Base64-encode ciphertext before transport and decode before decrypting.","Log the underlying exception (search '解密密码失败') to distinguish bad-key vs bad-ciphertext.","Add round-trip encrypt/decrypt unit tests on key rotation."],"tags":["java","aes","decryption","crypto"],"backgroundTag":"decryption-failed","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}