chenhg5/cc-connect · error

%s: decrypt: %w

Error message

%s: decrypt: %w

What it means

AES-128-ECB decryption of the downloaded CDN ciphertext failed in downloadAndDecryptCDN — typically because the ciphertext is not block-aligned (wrong/truncated data) or PKCS7 unpadding was invalid, meaning the aes_key does not match the media or the download was corrupted.

Source

Thrown at platform/weixin/cdn.go:163

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("%s: CDN http %d: %s", label, resp.StatusCode, truncateForLog(body, 256))
	}
	return body, nil
}

func downloadAndDecryptCDN(ctx context.Context, client *http.Client, cdnBase, encParam, aesKeyBase64, label string) ([]byte, error) {
	key, err := parseAesKey(aesKeyBase64, label)
	if err != nil {
		return nil, err
	}
	u := buildCdnDownloadURL(encParam, cdnBase)
	enc, err := fetchCdnBytes(ctx, client, u, label)
	if err != nil {
		return nil, err
	}
	plain, err := decryptAESECB(enc, key)
	if err != nil {
		return nil, fmt.Errorf("%s: decrypt: %w", label, err)
	}
	return plain, nil
}

func downloadPlainCDN(ctx context.Context, client *http.Client, cdnBase, encParam, label string) ([]byte, error) {
	u := buildCdnDownloadURL(encParam, cdnBase)
	return fetchCdnBytes(ctx, client, u, label)
}

const cdnUploadMaxRetries = 3

// uploadBufferToCDN encrypts plaintext with AES-128-ECB and uploads to the given CDN URL.
// Caller is responsible for building the full URL (via buildCdnUploadURL or from upload_full_url).
func uploadBufferToCDN(ctx context.Context, client *http.Client, cdnURL string, plaintext, aesKey []byte, label string) (downloadParam string, err error) {
	ciphertext, err := encryptAESECB(plaintext, aesKey)
	if err != nil {
		return "", fmt.Errorf("%s: encrypt: %w", label, err)
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Verify the aes_key was parsed with the correct interpretation (raw 16 bytes vs hex-wrapped) for this media item
2. Re-download the ciphertext and retry once in case of corruption
3. On persistent failure, skip the attachment and notify the user rather than dropping the entire message

When it happens

Trigger: Thrown at platform/weixin/cdn.go:163 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/0bbd83f2fc49dd92. Report an issue: GitHub.