{"record":{"id":"dcc0740099861727","repo":"w7corp/easywechat","slug":"blocksize-may-not-be-more-than-32-bytes-256-bits","errorCode":null,"errorMessage":"$blockSize may not be more than 32 bytes(256 bits)","messagePattern":"\\$blockSize may not be more than 32 bytes\\(256 bits\\)","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"src/Kernel/Support/Pkcs7.php","lineNumber":15,"sourceCode":"<?php\n\nnamespace EasyWeChat\\Kernel\\Support;\n\nuse EasyWeChat\\Kernel\\Exceptions\\InvalidArgumentException;\n\nclass Pkcs7\n{\n    /**\n     * @throws InvalidArgumentException\n     */\n    public static function padding(string $contents, int $blockSize): string\n    {\n        if ($blockSize > 32) {\n            throw new InvalidArgumentException('$blockSize may not be more than 32 bytes(256 bits)');\n        }\n        $padding = $blockSize - (strlen($contents) % $blockSize);\n        $pattern = chr($padding);\n\n        return $contents.str_repeat($pattern, $padding);\n    }\n\n    public static function unpadding(string $contents, int $blockSize): string\n    {\n        $pad = ord(substr($contents, -1));\n        if ($pad < 1 || $pad > $blockSize) {\n            $pad = 0;\n        }\n\n        return substr($contents, 0, (strlen($contents) - $pad));\n    }\n}\n","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/w7corp/easywechat/blob/f0cf0a8b8361417ed683b8246d0ecbaf0aafcaa8/src/Kernel/Support/Pkcs7.php#L1-L33","documentation":"Pkcs7::padding rejects a blockSize larger than 32 bytes (256 bits). Internally Encryptor::encryptAsArray (src/Kernel/Encryptor.php:141) passes blockSize: strlen($this->aesKey) where aesKey = base64_decode(EncodingAESKey.'=') — a valid 43-char key decodes to exactly 32 bytes. A larger value therefore means the aesKey string was malformed, or direct code passed bits instead of bytes; the exception is re-thrown by Encryptor as RuntimeException with code ERROR_ENCRYPT_AES.","triggerScenarios":"new Encryptor($appId, $token, $aesKey) with an aes_key that base64-decodes to more than 32 bytes (wrong length, extra padding characters, or the app Secret pasted instead of the EncodingAESKey), then calling encrypt()/encryptAsArray(); calling Pkcs7::padding($data, 256) or any value over 32 directly.","commonSituations":"Pasting the app Secret or a 44+ char string into aes_key; hand-rolled encryption copying the WeChat scheme and passing block size in bits; migrations from SDK 5.x carrying over an old key format.","solutions":["Use the exact 43-char EncodingAESKey from the console — Encryptor appends '=' and decodes it to 32 bytes.","When calling Pkcs7 directly, pass blockSize in bytes: 32 for the WeChat scheme, 16 for standard AES.","Validate at boot: strlen(base64_decode($aesKey.'=', true)) === 32.","trim() whitespace and newlines from config keys before constructing Encryptor."],"exampleFix":"// before: blockSize passed in bits -> always > 32 -> exception\n$padded = Pkcs7::padding($data, 256);\n// after: bytes — 32 for the WeChat scheme, 16 for standard AES\n$padded = Pkcs7::padding($data, 32);","handlingStrategy":"validation","validationCode":"$raw = base64_decode($aesKey.'=', true);\nif ($raw === false || strlen($raw) !== 32) { throw new InvalidArgumentException('EncodingAESKey must be 43 chars decoding to 32 bytes'); }\nif ($blockSize < 1 || $blockSize > 32) { throw new InvalidArgumentException('blockSize must be between 1 and 32 bytes'); }","typeGuard":null,"tryCatchPattern":"try { $enc = $encryptor->encrypt($xml); } catch (\\EasyWeChat\\Kernel\\Exceptions\\RuntimeException $e) { // carries '$blockSize may not be more than 32 bytes' when the aesKey length is wrong \\Log::error('encrypt failed: '.$e->getMessage()); throw $e; }","preventionTips":["Validate the 43-char EncodingAESKey at bootstrap","Keep one linted config source for keys","Never hand-roll WeChat padding — reuse Encryptor"],"tags":["php","pkcs7","padding","encryption","config"],"backgroundTag":"invalid-key-length","analyzedSha":"f0cf0a8b8361417ed683b8246d0ecbaf0aafcaa8","analyzedAt":"2026-08-21T05:29:19.565Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}