chenhg5/cc-connect · error

invalid ciphertext length %d

Error message

invalid ciphertext length %d

What it means

Structural guard on the decoded ciphertext in decrypt: its byte length is either below the AES block size (16) or not a multiple of it, so AES-256-CBC cannot process it. This means the Base64 input decoded to a malformed ciphertext — typically a truncated or tampered encrypt field rather than a WeCom-originated message.

Source

Thrown at platform/wecom/wecom.go:761

}

// decrypt decodes and decrypts a Base64-encoded AES-256-CBC ciphertext.
// Layout after decryption + PKCS#7 unpad:
//
//	[16 bytes random] [4 bytes msg_len (big-endian)] [msg_len bytes message] [corp_id]
func (p *Platform) decrypt(cipherBase64 string) (string, error) {
	cipherData, err := base64.StdEncoding.DecodeString(cipherBase64)
	if err != nil {
		return "", fmt.Errorf("base64 decode: %w", err)
	}

	block, err := aes.NewCipher(p.aesKey)
	if err != nil {
		return "", fmt.Errorf("aes new cipher: %w", err)
	}

	if len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {
		return "", fmt.Errorf("invalid ciphertext length %d", len(cipherData))
	}

	iv := p.aesKey[:16]
	mode := cipher.NewCBCDecrypter(block, iv)
	plain := make([]byte, len(cipherData))
	mode.CryptBlocks(plain, cipherData)

	plain = pkcs7Unpad(plain)

	if len(plain) < 20 {
		return "", fmt.Errorf("decrypted data too short")
	}

	msgLen := int(binary.BigEndian.Uint32(plain[16:20]))
	if 20+msgLen > len(plain) {
		return "", fmt.Errorf("invalid message length %d in decrypted data (total %d)", msgLen, len(plain))
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Reject the callback; do not retry — malformed ciphertext never self-heals
2. Check for body truncation by proxies or size limits on the callback endpoint
3. Verify the payload passed signature verification; forgeries often fail this length check

When it happens

Trigger: Thrown at platform/wecom/wecom.go:761 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/bbe80b4467559a17. Report an issue: GitHub.