fish2018/pansou · error

无效的填充字节

Error message

无效的填充字节

What it means

After a plausible padding length is read, removePKCS7Padding verifies that all trailing paddingLen bytes equal byte(paddingLen), as PKCS#7 requires. If any padding byte differs, the padding is malformed and the function fails with 无效的填充字节. Like the padding-length error, this usually means the ciphertext was decrypted with the wrong key/IV or the data was altered.

Solutions

1. Confirm AESKey/AESIV match the current site parameters — uniform-padding violations after decrypt point to wrong-key garbage.
2. Re-fetch a fresh encrypted token instead of using cached/stale values.
3. Dump the decrypted plaintext in hex and check the final block; if trailing bytes are random, fix key/IV rather than relaxing the padding check.
4. Verify the site truly uses PKCS#7; if it uses zero- or no-padding, replace removePKCS7Padding with the appropriate unpadding routine.

Example fix

// before
unpaddedText, err := removePKCS7Padding(plaintext)
if err != nil {
    return "", err
}
// after
unpaddedText, err := removePKCS7Padding(plaintext)
if err != nil {
    return "", fmt.Errorf("bad PKCS7 padding after decrypt (len=%d): %w — verify AESKey/AESIV", len(plaintext), err)
}

plain, err := DecryptURL(enc)
if err != nil {
    if strings.Contains(err.Error(), "无效的填充字节") {
        // decryption produced non-uniform trailing bytes: wrong key/IV or corrupted data
        return reFetchAndDecrypt(item)
    }
    return err
}

When it happens

Trigger: AES-CBC decryption with incorrect AESKey/AESIV produces plaintext whose trailing bytes are not uniform; ciphertext modified during transport (e.g. case-insensitive Base64 handling, encoding round-trips); data encrypted with non-PKCS7 padding such as ISO/ANSI or zero padding.

Common situations: SDSO site rotated its encryption key so old hardcoded constants decrypt to noise; cached encrypted URL from an older site format; ciphertext altered by encoding round-trips (URL decoding, charset conversion) during transport.

Related errors

• 去除填充失败
• 无效的填充长度
• 密文长度不是AES块大小的倍数
• 创建AES加密器失败
• IV长度不正确: 期望 ，实际

AI-assisted analysis of fish2018/pansou@beaa561337 (2026-09-07). Data as JSON: /api/errors/fe3b7e59d1af1c6c. Report an issue: GitHub.

Appendix: source

Thrown at plugin/sdso/sdso.go:443

// removePKCS7Padding 去除PKCS7填充
func removePKCS7Padding(data []byte) ([]byte, error) {
	if len(data) == 0 {
		return nil, fmt.Errorf("数据为空")
	}

	// 获取填充长度
	paddingLen := int(data[len(data)-1])

	// 验证填充长度
	if paddingLen == 0 || paddingLen > len(data) || paddingLen > aes.BlockSize {
		return nil, fmt.Errorf("无效的填充长度: %d", paddingLen)
	}

	// 验证填充字节
	for i := len(data) - paddingLen; i < len(data); i++ {
		if data[i] != byte(paddingLen) {
			return nil, fmt.Errorf("无效的填充字节")
		}
	}

	// 返回去除填充后的数据
	return data[:len(data)-paddingLen], nil
}

// cleanHTMLTags 清理HTML标签
func cleanHTMLTags(text string) string {
	// 移除高亮标签 <span style="color: red;">...</span>
	re := regexp.MustCompile(`<span[^>]*>(.*?)</span>`)
	cleaned := re.ReplaceAllString(text, "$1")
	
	// 移除其他可能的HTML标签
	re2 := regexp.MustCompile(`<[^>]*>`)
	cleaned = re2.ReplaceAllString(cleaned, "")
	
	return strings.TrimSpace(cleaned)

View on GitHub (pinned to beaa561337)