chenhg5/cc-connect · error

aes new cipher: %w

Error message

aes new cipher: %w

What it means

Wrap of aes.NewCipher on the platform's decoded EncodingAESKey inside decrypt. Because the 43-char length check upstream guarantees a 32-byte key — the only size aes.NewCipher rejects — this is a defensive invariant wrap; if it fires, the key derivation/length guard chain is inconsistent or the key was mutated after New().

Source

Thrown at platform/wecom/wecom.go:757

	if len(encodingAESKey) != 43 {
		return nil, fmt.Errorf("EncodingAESKey must be 43 characters, got %d", len(encodingAESKey))
	}
	return base64.StdEncoding.DecodeString(encodingAESKey + "=")
}

// decrypt decodes and decrypts a Base64-encoded AES-256-CBC ciphertext.
// Layout after decryption + PKCS#7 unpad:
//
//	[16 bytes random] [4 bytes msg_len (big-endian)] [msg_len bytes message] [corp_id]
func (p *Platform) decrypt(cipherBase64 string) (string, error) {
	cipherData, err := base64.StdEncoding.DecodeString(cipherBase64)
	if err != nil {
		return "", fmt.Errorf("base64 decode: %w", err)
	}

	block, err := aes.NewCipher(p.aesKey)
	if err != nil {
		return "", fmt.Errorf("aes new cipher: %w", err)
	}

	if len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {
		return "", fmt.Errorf("invalid ciphertext length %d", len(cipherData))
	}

	iv := p.aesKey[:16]
	mode := cipher.NewCBCDecrypter(block, iv)
	plain := make([]byte, len(cipherData))
	mode.CryptBlocks(plain, cipherData)

	plain = pkcs7Unpad(plain)

	if len(plain) < 20 {
		return "", fmt.Errorf("decrypted data too short")
	}

	msgLen := int(binary.BigEndian.Uint32(plain[16:20]))

View on GitHub (pinned to 4000b2338a)

Solutions

1. Treat as an assertion failure: log the key length (not the key) and investigate
2. Ensure p.aesKey is set once in New and never overwritten elsewhere
3. No runtime input can trigger this given the 43-char validation held

When it happens

Trigger: Thrown at platform/wecom/wecom.go:757 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/f076e976bf79514e. Report an issue: GitHub.