chenhg5/cc-connect · error

%s: aes_key base64: %w

Error message

%s: aes_key base64: %w

What it means

parseAesKey decodes the CDNMedia.aes_key field, which must be base64 encoding of either 16 raw key bytes or 32 hex-ASCII characters; if base64.StdEncoding.DecodeString fails (invalid characters, wrong length mod 4, padding issues) the error is wrapped as '<label>: aes_key base64: %w' with the underlying base64 error. The label identifies which media/URL the bad key came from.

Source

Thrown at platform/weixin/cdn.go:94

	if len(ciphertext)%aes.BlockSize != 0 {
		return nil, fmt.Errorf("ciphertext length %d not aligned to block", len(ciphertext))
	}
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	out := make([]byte, len(ciphertext))
	for i := 0; i < len(ciphertext); i += aes.BlockSize {
		block.Decrypt(out[i:i+aes.BlockSize], ciphertext[i:i+aes.BlockSize])
	}
	return pkcs7Unpad(out, aes.BlockSize)
}

// parseAesKey decodes CDNMedia.aes_key: base64(raw 16 bytes) or base64(32-char hex ASCII) → 16 bytes.
func parseAesKey(aesKeyBase64, label string) ([]byte, error) {
	decoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(aesKeyBase64))
	if err != nil {
		return nil, fmt.Errorf("%s: aes_key base64: %w", label, err)
	}
	if len(decoded) == 16 {
		return decoded, nil
	}
	if len(decoded) == 32 {
		s := string(decoded)
		if hex32RE.MatchString(s) {
			k, err := hex.DecodeString(s)
			if err != nil {
				return nil, fmt.Errorf("%s: aes_key hex inside base64: %w", label, err)
			}
			return k, nil
		}
	}
	return nil, fmt.Errorf("%s: aes_key must be 16 raw bytes or 32-char hex (base64-wrapped), got %d bytes after base64", label, len(decoded))
}

func buildCdnDownloadURL(encryptedQueryParam, cdnBase string) string {

View on GitHub (pinned to 4000b2338a)

Solutions

1. Check the raw aes_key string: it must be valid standard base64 (length %4==0 after TrimSpace, only A-Za-z0-9+/=)
2. If the key is raw hex (32 chars), wrap it: base64.StdEncoding.EncodeToString([]byte(hexStr)) or hex-decode it yourself to 16 bytes and pass those
3. Confirm the CDN API response actually populated aes_key; re-fetch the media metadata if empty
4. Use base64.RawStdEncoding or sanitize URL-safe characters if the upstream uses -/_
5. Log the label in the wrapped error to identify which media item's key is malformed

Example fix

// before
key, err := parseAesKey(rawHexKey, "cdn") // raw hex is not base64
// after
if isHex(rawHexKey) && len(rawHexKey) == 32 {
    rawHexKey = base64.StdEncoding.EncodeToString([]byte(rawHexKey))
}
key, err := parseAesKey(rawHexKey, "cdn")

k := strings.TrimSpace(media.AesKey)
if k == "" { return errors.New("aes_key missing") }
if _, err := base64.StdEncoding.DecodeString(k); err != nil {
    return fmt.Errorf("aes_key not valid base64: %w", err)
}

key, err := parseAesKey(media.AesKey, media.URL)
if err != nil {
    var b64 base64.CorruptInputError
    if errors.As(err, &b64) {
        log.Warn("aes_key not standard base64; trying url-safe/hex fallback")
        return tryFallbackKeyDecodings(media.AesKey)
    }
    return err
}

When it happens

Trigger: The aes_key field contains a raw (non-base64) hex string like 'a1b2...' passed straight in; whitespace/newlines beyond what TrimSpace removes (internal spaces); URL-safe base64 ('-','_') instead of standard base64; the API returned an empty or placeholder aes_key; JSON marshaling mangled the field.

Common situations: WeChat Work API responses where aes_key is missing and an empty string is decoded (DecodeString('') succeeds but the follow-on length check fails — this error fires for truly malformed base64); hand-editing config files; logging/copy mistakes truncating the key.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• wecom-ws: invalid aeskey base64 length
• wecom-ws: decode aeskey: %w
• invalid padded length %d
• invalid pkcs7 padding
• aes key must be 16 bytes, got %d

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/fa8a4b206ccf38b9. Report an issue: GitHub.