chenhg5/cc-connect · error

wecom-ws: aeskey decoded length %d, need >= 32

Error message

wecom-ws: aeskey decoded length %d, need >= 32

What it means

decodeWeComAESKey decodes successfully but the resulting byte slice is shorter than 32 bytes, which cannot serve as an AES-256 key. wecomDecryptFile slices key[:32], so a short key would panic; this check converts that into a descriptive error reporting the actual decoded length.

Source

Thrown at platform/wecom/websocket_media.go:251

	s = strings.ReplaceAll(s, "-", "+")
	s = strings.ReplaceAll(s, "_", "/")

	switch len(s) % 4 {
	case 0:
	case 2:
		s += "=="
	case 3:
		s += "="
	default:
		return nil, fmt.Errorf("wecom-ws: invalid aeskey base64 length")
	}

	key, err := base64.StdEncoding.DecodeString(s)
	if err != nil {
		return nil, fmt.Errorf("wecom-ws: decode aeskey: %w", err)
	}
	if len(key) < 32 {
		return nil, fmt.Errorf("wecom-ws: aeskey decoded length %d, need >= 32", len(key))
	}
	return key, nil
}

func isHexString(s string) bool {
	for i := 0; i < len(s); i++ {
		c := s[i]
		switch {
		case c >= '0' && c <= '9', c >= 'a' && c <= 'f', c >= 'A' && c <= 'F':
		default:
			return false
		}
	}
	return true
}

// wecomDecryptFile decrypts payload from WeCom WS media URLs (AES-256-CBC, IV = first 16 key bytes).
// Same algorithm as @wecom/aibot-node-sdk decryptFile.

View on GitHub (pinned to 4000b2338a)

Solutions

1. Verify the key is the full EncodingAESKey (43 unpatched base64 chars → 32 bytes) from the WeCom bot settings.
2. Compute base64.StdEncoding.DecodeString offline and check len(key) == 32 before deploying the config.
3. If your deployment genuinely uses a 16-byte key, this code path expects AES-256; regenerate/configure a 32-byte key.

Example fix

// before
key := cfg.Token // wrong field, decodes to ~16 bytes
// after
key := cfg.EncodingAESKey // 43-char base64 -> 32 bytes
if k, err := base64.StdEncoding.DecodeString(key); err != nil || len(k) < 32 {
    return fmt.Errorf("aes key must decode to >=32 bytes")
}

func isAES256Key(b64 string) bool {
    k, err := base64.StdEncoding.DecodeString(strings.TrimSpace(b64))
    return err == nil && len(k) >= 32
}

When it happens

Trigger: Passing a base64 string that decodes to <32 bytes — e.g. a 16-byte AES-128 key, an auth token mistakenly used as the media AES key, or a partially pasted EncodingAESKey.

Common situations: Confusing the WeCom callback EncodingAESKey (43 chars, 32 bytes) with a shorter token or Secret; truncation by spreadsheet/config tooling; using a key generated for a different SDK.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• aes key must be 16 bytes, got %d
• wecom-ws: invalid aeskey base64 length
• wecom-ws: decode aeskey: %w
• wecom-ws: empty ciphertext
• wecom-ws: ciphertext not multiple of block size

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/503454037787dc52. Report an issue: GitHub.