chenhg5/cc-connect · error

wecom-ws: decode aeskey: %w

Error message

wecom-ws: decode aeskey: %w

What it means

After normalizing padding, decodeWeComAESKey decodes the key with base64.StdEncoding and wraps any decode failure with this error. It means the string is not valid standard base64 even though its length was plausible — it contains characters outside the base64 alphabet or malformed padding. The original stdlib error is preserved via %w for inspection.

Source

Thrown at platform/wecom/websocket_media.go:248

	}

	// URL-safe alphabet → standard (RFC 4648 §5)
	s = strings.ReplaceAll(s, "-", "+")
	s = strings.ReplaceAll(s, "_", "/")

	switch len(s) % 4 {
	case 0:
	case 2:
		s += "=="
	case 3:
		s += "="
	default:
		return nil, fmt.Errorf("wecom-ws: invalid aeskey base64 length")
	}

	key, err := base64.StdEncoding.DecodeString(s)
	if err != nil {
		return nil, fmt.Errorf("wecom-ws: decode aeskey: %w", err)
	}
	if len(key) < 32 {
		return nil, fmt.Errorf("wecom-ws: aeskey decoded length %d, need >= 32", len(key))
	}
	return key, nil
}

func isHexString(s string) bool {
	for i := 0; i < len(s); i++ {
		c := s[i]
		switch {
		case c >= '0' && c <= '9', c >= 'a' && c <= 'f', c >= 'A' && c <= 'F':
		default:
			return false
		}
	}
	return true
}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Inspect errors.Is/As on the wrapped stdlib base64.CorruptInputError to find the offending byte offset.
2. Convert URL-safe base64 to standard: strings.NewReplacer('-','+','_','/').Replace(key) before decoding.
3. Re-export the EncodingAESKey from the WeCom admin console and paste it unmodified (43/44 char base64).

Example fix

// before
plain, err := wecomDecryptFile(ct, urlSafeKey) // contains '-' or '_'
// after
std := strings.NewReplacer("-", "+", "_", "/").Replace(strings.TrimSpace(urlSafeKey))
plain, err := wecomDecryptFile(ct, std)

func canDecodeBase64(s string) bool {
    _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(s))
    return err == nil
}

if _, err := wecomDecryptFile(ct, key); err != nil {
    var cie base64.CorruptInputError
    if errors.As(err, &cie) { log.Printf("bad base64 at offset %d", int64(cie)) }
}

When it happens

Trigger: wecomDecryptFile called with aesKeyB64 containing invalid characters (spaces, '-', '_' from URL-safe encoding without conversion, unicode, or '=' in the middle of the string).

Common situations: WeCom keys pasted from URLs where '+/' were replaced by '-_'; config file values with embedded spaces or quotes; key accidentally URL-encoded ('%2B' etc.); trimming left a trailing newline encoded oddly.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• wecom-ws: invalid aeskey base64 length
• wecom-ws: aeskey decoded length %d, need >= 32
• wecom-ws: empty ciphertext
• wecom-ws: ciphertext not multiple of block size
• wecom-ws: empty padded data

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/b82cc691ab9e5ccf. Report an issue: GitHub.