chenhg5/cc-connect · error

wecom-ws: aeskey hex length %d, want 32 bytes

Error message

wecom-ws: aeskey hex length %d, want 32 bytes

What it means

Length check inside decodeWeComAESKey's hex branch: the 64 hex characters decoded successfully but did not yield the 32 bytes required for AES-256. Since 64 hex chars always decode to 32 bytes, this guard is a defensive invariant — firing it means the decoder or the preceding isHexString/length checks are inconsistent.

Source

Thrown at platform/wecom/websocket_media.go:227

	var b strings.Builder
	b.Grow(len(s))
	for i := 0; i < len(s); i++ {
		switch s[i] {
		case '\n', '\r', ' ', '\t':
			continue
		default:
			b.WriteByte(s[i])
		}
	}
	s = b.String()

	if len(s) == 64 && isHexString(s) {
		key, err := hex.DecodeString(s)
		if err != nil {
			return nil, fmt.Errorf("wecom-ws: decode aeskey hex: %w", err)
		}
		if len(key) != 32 {
			return nil, fmt.Errorf("wecom-ws: aeskey hex length %d, want 32 bytes", len(key))
		}
		return key, nil
	}

	// URL-safe alphabet → standard (RFC 4648 §5)
	s = strings.ReplaceAll(s, "-", "+")
	s = strings.ReplaceAll(s, "_", "/")

	switch len(s) % 4 {
	case 0:
	case 2:
		s += "=="
	case 3:
		s += "="
	default:
		return nil, fmt.Errorf("wecom-ws: invalid aeskey base64 length")
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Treat as a defensive assertion failure: log loudly and investigate rather than papering over
2. Skip decryption for the affected media item so the rest of the message still delivers
3. Keep the guard as a safety net; no configuration change can trigger it under correct hex arithmetic

When it happens

Trigger: Thrown at platform/wecom/websocket_media.go:227 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/16ba2b9cef6ecc62. Report an issue: GitHub.