chenhg5/cc-connect · error

decrypted data too short

Error message

decrypted data too short

What it means

Post-decryption sanity guard: after AES-CBC decryption and PKCS#7 unpadding, the plaintext is shorter than the minimum 20 bytes needed for WeCom's layout (16-byte random prefix + 4-byte big-endian message length). A payload this small cannot be a legitimate WeCom-encrypted message, indicating a wrong key or corrupted ciphertext that nonetheless decrypted.

Source

Thrown at platform/wecom/wecom.go:772

	block, err := aes.NewCipher(p.aesKey)
	if err != nil {
		return "", fmt.Errorf("aes new cipher: %w", err)
	}

	if len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {
		return "", fmt.Errorf("invalid ciphertext length %d", len(cipherData))
	}

	iv := p.aesKey[:16]
	mode := cipher.NewCBCDecrypter(block, iv)
	plain := make([]byte, len(cipherData))
	mode.CryptBlocks(plain, cipherData)

	plain = pkcs7Unpad(plain)

	if len(plain) < 20 {
		return "", fmt.Errorf("decrypted data too short")
	}

	msgLen := int(binary.BigEndian.Uint32(plain[16:20]))
	if 20+msgLen > len(plain) {
		return "", fmt.Errorf("invalid message length %d in decrypted data (total %d)", msgLen, len(plain))
	}

	msg := string(plain[20 : 20+msgLen])
	corpID := string(plain[20+msgLen:])

	if corpID != p.corpID {
		return "", fmt.Errorf("corp_id mismatch: expected %s, got %s", p.corpID, corpID)
	}

	return msg, nil
}

func pkcs7Unpad(data []byte) []byte {

View on GitHub (pinned to 4000b2338a)

Solutions

1. First suspect the EncodingAESKey: a wrong-but-valid-length key decrypts to garbage that fails this check
2. Compare the key against the WeCom admin console for the same app
3. Reject the callback; retries cannot fix a key mismatch

When it happens

Trigger: Thrown at platform/wecom/wecom.go:772 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/4d8bf7220daba8da. Report an issue: GitHub.