fish2018/pansou · error

密文长度不足

Error message

密文长度不足

What it means

The AES-GCM decryption helper checks that the ciphertext blob is at least as long as the GCM nonce size before splitting it. If the input data is shorter than gcm.NonceSize(), decryption cannot proceed and this error is returned.

Solutions

1. Verify the stored credential is a complete ciphertext produced by the matching encrypt helper (re-encrypt the source value)
2. Check that base64/hex decoding happens before decryption and that no characters were lost
3. Confirm the same key is used for encryption and decryption so the blob is not misinterpreted
4. Add a length check on the caller side before attempting decryption

Example fix

// before
plain, err := decrypt(cfg.Password)
if err != nil { return err }
// after
if len(cfg.Password) < 28 { // nonce(12) + tag(16), pre-encoded sanity check
    return errors.New("存储的密码密文缺失或为空，请重新配置")
}
plain, err := decrypt(cfg.Password)
if err != nil { return err }

raw, err := base64.StdEncoding.DecodeString(enc)
if err != nil {
    return fmt.Errorf("credential is not valid base64 ciphertext: %w", err)
}
if len(raw) < 12+16 {
    return errors.New("ciphertext too short; re-encrypt the value")
}

plain, err := decrypt(enc)
if err != nil {
    if err.Error() == "密文长度不足" {
        return errors.New("stored credential missing/corrupted; reconfigure password")
    }
    return err
}

When it happens

Trigger: Decrypting an empty string, a plaintext value mistakenly passed as ciphertext, a truncated/corrupted stored credential, or data that was not produced by the matching encrypt function.

Common situations: Config/db credential field empty or overwritten with plaintext; base64 decoding producing wrong bytes (wrong encoding, whitespace); manual copy-paste losing characters; encrypt/decrypt key or format version mismatch.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• ciphertext too short
• ciphertext too short
• 加密URL不能为空
• Base64解码失败
• 密文长度为0

AI-assisted analysis of fish2018/pansou@beaa561337 (2026-09-07). Data as JSON: /api/errors/0d82e058fe443f30. Report an issue: GitHub.

Appendix: source

Thrown at plugin/panlian/panlian.go:1864

	ciphertext := gcm.Seal(nonce, nonce, []byte(password), nil)
	return base64.StdEncoding.EncodeToString(ciphertext), nil
}

func (p *PanlianPlugin) decryptPassword(encrypted string) (string, error) {
	data, err := base64.StdEncoding.DecodeString(encrypted)
	if err != nil {
		return "", err
	}
	block, err := aes.NewCipher(getEncryptionKey())
	if err != nil {
		return "", err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}
	if len(data) < gcm.NonceSize() {
		return "", fmt.Errorf("密文长度不足")
	}
	nonce := data[:gcm.NonceSize()]
	ciphertext := data[gcm.NonceSize():]
	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return "", err
	}
	return string(plaintext), nil
}

View on GitHub (pinned to beaa561337)