chenhg5/cc-connect · error

base64 decode: %w

Error message

base64 decode: %w

What it means

Base64 decode failure on the encrypt field of an inbound WeCom callback: the ciphertext string submitted by the caller (or the signature-verified payload) is not valid standard Base64, so AES decryption cannot even start. Usually a truncated or URL-mangled payload, or a callback not originating from WeCom.

Source

Thrown at platform/wecom/wecom.go:752

	return got == expected
}

// decodeAESKey converts the 43-char Base64 EncodingAESKey to 32 bytes.
func decodeAESKey(encodingAESKey string) ([]byte, error) {
	if len(encodingAESKey) != 43 {
		return nil, fmt.Errorf("EncodingAESKey must be 43 characters, got %d", len(encodingAESKey))
	}
	return base64.StdEncoding.DecodeString(encodingAESKey + "=")
}

// decrypt decodes and decrypts a Base64-encoded AES-256-CBC ciphertext.
// Layout after decryption + PKCS#7 unpad:
//
//	[16 bytes random] [4 bytes msg_len (big-endian)] [msg_len bytes message] [corp_id]
func (p *Platform) decrypt(cipherBase64 string) (string, error) {
	cipherData, err := base64.StdEncoding.DecodeString(cipherBase64)
	if err != nil {
		return "", fmt.Errorf("base64 decode: %w", err)
	}

	block, err := aes.NewCipher(p.aesKey)
	if err != nil {
		return "", fmt.Errorf("aes new cipher: %w", err)
	}

	if len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {
		return "", fmt.Errorf("invalid ciphertext length %d", len(cipherData))
	}

	iv := p.aesKey[:16]
	mode := cipher.NewCBCDecrypter(block, iv)
	plain := make([]byte, len(cipherData))
	mode.CryptBlocks(plain, cipherData)

	plain = pkcs7Unpad(plain)

View on GitHub (pinned to 4000b2338a)

Solutions

1. Reject the callback with an error response rather than retrying — the payload is corrupted
2. Verify no intermediary (proxy/gateway) re-encodes or truncates the POST body
3. Confirm signature verification passed first; unsigned foreign requests naturally fail here

When it happens

Trigger: Thrown at platform/wecom/wecom.go:752 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/c84e88cd5a372bdb. Report an issue: GitHub.