chenhg5/cc-connect · error

%s: encrypt: %w

Error message

%s: encrypt: %w

What it means

AES-128-ECB encryption of the outgoing media buffer failed in uploadBufferToCDN — crypto/aes rejected the key generated for the upload (e.g. wrong key length after key generation) or block encryption failed, so the media could not be prepared for Weixin CDN upload.

Source

Thrown at platform/weixin/cdn.go:180

	if err != nil {
		return nil, fmt.Errorf("%s: decrypt: %w", label, err)
	}
	return plain, nil
}

func downloadPlainCDN(ctx context.Context, client *http.Client, cdnBase, encParam, label string) ([]byte, error) {
	u := buildCdnDownloadURL(encParam, cdnBase)
	return fetchCdnBytes(ctx, client, u, label)
}

const cdnUploadMaxRetries = 3

// uploadBufferToCDN encrypts plaintext with AES-128-ECB and uploads to the given CDN URL.
// Caller is responsible for building the full URL (via buildCdnUploadURL or from upload_full_url).
func uploadBufferToCDN(ctx context.Context, client *http.Client, cdnURL string, plaintext, aesKey []byte, label string) (downloadParam string, err error) {
	ciphertext, err := encryptAESECB(plaintext, aesKey)
	if err != nil {
		return "", fmt.Errorf("%s: encrypt: %w", label, err)
	}
	u := cdnURL
	var lastErr error
	for attempt := 1; attempt <= cdnUploadMaxRetries; attempt++ {
		req, err := http.NewRequestWithContext(ctx, http.MethodPost, u, bytes.NewReader(ciphertext))
		if err != nil {
			return "", fmt.Errorf("%s: new request: %w", label, err)
		}
		req.Header.Set("Content-Type", "application/octet-stream")
		resp, err := client.Do(req)
		if err != nil {
			lastErr = err
			slog.Warn("weixin: CDN upload request failed", "label", label, "attempt", attempt, "error", err)
			continue
		}
		_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
		_ = resp.Body.Close()
		if resp.StatusCode >= 400 && resp.StatusCode < 500 {

View on GitHub (pinned to 4000b2338a)

Solutions

1. Ensure the generated upload key is exactly 16 bytes (AES-128) before encrypting
2. Log key length and plaintext size to pinpoint the crypto failure
3. Fail the specific send and report to the user; retry the whole upload with a fresh key

When it happens

Trigger: Thrown at platform/weixin/cdn.go:180 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/b7333cae90e793b2. Report an issue: GitHub.