chenhg5/cc-connect · warning

wecom-ws: empty padded data

Error message

wecom-ws: empty padded data

What it means

pkcs7UnpadWeCom refuses to unpad a zero-length plaintext buffer. In this code path it is effectively unreachable via wecomDecryptFile (ciphertext is validated as a non-empty multiple of 16 first), but it is exported as a guard for direct callers. It protects the last-byte pad-length read from an index panic.

Source

Thrown at platform/wecom/websocket_media.go:295

	}
	key32 := key[:32]
	iv := key32[:16]

	block, err := aes.NewCipher(key32)
	if err != nil {
		return nil, err
	}
	if len(ciphertext)%aes.BlockSize != 0 {
		return nil, fmt.Errorf("wecom-ws: ciphertext not multiple of block size")
	}
	plain := make([]byte, len(ciphertext))
	cipher.NewCBCDecrypter(block, iv).CryptBlocks(plain, ciphertext)
	return pkcs7UnpadWeCom(plain)
}

func pkcs7UnpadWeCom(data []byte) ([]byte, error) {
	if len(data) == 0 {
		return nil, fmt.Errorf("wecom-ws: empty padded data")
	}
	padLen := int(data[len(data)-1])
	if padLen < 1 || padLen > 32 || padLen > len(data) {
		return nil, fmt.Errorf("wecom-ws: invalid pkcs7 pad length %d", padLen)
	}
	for i := len(data) - padLen; i < len(data); i++ {
		if int(data[i]) != padLen {
			return nil, fmt.Errorf("wecom-ws: invalid pkcs7 padding")
		}
	}
	return data[:len(data)-padLen], nil
}

func parseContentDispositionFilename(h string) string {
	h = strings.TrimSpace(h)
	if h == "" {
		return ""
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Check len(data) == 0 before calling pkcs7UnpadWeCom, or rely on wecomDecryptFile which pre-validates ciphertext.
2. If data is empty after decryption, treat the media as corrupt and re-download rather than unpadding.

Example fix

// before
plain := make([]byte, 0)
out, err := pkcs7UnpadWeCom(plain)
// after
if len(plain) == 0 {
    return nil, fmt.Errorf("nothing decrypted")
}
out, err := pkcs7UnpadWeCom(plain)

if plain == nil || len(plain) == 0 {
    return nil, fmt.Errorf("nothing to unpad")
}

func nonEmpty(b []byte) bool { return len(b) > 0 }

When it happens

Trigger: Calling pkcs7UnpadWeCom directly with an empty (or nil) slice — e.g. decrypting produced a zero-length buffer or a caller passed a manually decrypted empty block stream.

Common situations: Custom decryption pipelines reusing the helper; tests exercising edge cases; refactoring that moved the empty check out of wecomDecryptFile.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• wecom-ws: invalid pkcs7 pad length %d
• wecom-ws: invalid pkcs7 padding
• wecom-ws: invalid aeskey base64 length
• wecom-ws: decode aeskey: %w
• wecom-ws: aeskey decoded length %d, need >= 32

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/e83cbc9decbcf8eb. Report an issue: GitHub.