fish2018/pansou · error

去除填充失败

Error message

去除填充失败: %w

What it means

After AES-CBC decryption, DecryptURL calls removePKCS7Padding to strip PKCS#7 padding from the plaintext. If the padding removal fails (empty data, invalid padding length, or padding bytes that don't match), the error is wrapped as 去除填充失败. This almost always means the ciphertext was decrypted with the wrong key/IV or the data was corrupted, since valid PKCS#7 padding rarely appears by accident.

Solutions

1. Confirm AESKey and AESIV match the current SDSO site encryption parameters; update the constants if the site rotated keys.
2. Re-fetch a fresh encrypted URL instead of decrypting a stale cached one.
3. Log len(ciphertext) and the raw decrypted bytes (hex) on failure to see whether decryption output is garbage (wrong key) or plausible text with bad padding (corruption).
4. Check for Base64 variant mismatch: try RawStdEncoding/URL-safe decoding if the token contains '-' or '_' or lacks padding.

Example fix

// before
unpaddedText, err := removePKCS7Padding(plaintext)
if err != nil {
    return "", fmt.Errorf("去除填充失败: %w", err)
}
// after
unpaddedText, err := removePKCS7Padding(plaintext)
if err != nil {
    return "", fmt.Errorf("去除填充失败 (len=%d; check AESKey/AESIV): %w", len(plaintext), err)
}

plain, err := DecryptURL(enc)
if err != nil {
    if strings.Contains(err.Error(), "去除填充失败") {
        // wrong key/IV or corrupted data: refresh token and re-fetch
        enc = fetchFreshEncryptedURL(item)
        plain, err = DecryptURL(enc)
    }
    if err != nil { return err }
}

When it happens

Trigger: DecryptURL receives ciphertext whose decryption does not end in valid PKCS#7 padding — wrong AESKey/AESIV for the data, ciphertext truncated then manually padded to a block boundary, or the site switched encryption schemes so the payload is not AES-CBC+PKCS7 anymore.

Common situations: Site rotated its encryption key/version while clients still use the old hardcoded AESKey/AESIV; encrypted URL stored/cached from an older site format; ciphertext mangled during transmission (URL-decoding double-applied, Base64 variant mismatch).

Related errors

• 无效的填充长度
• 无效的填充字节
• 密文长度不是AES块大小的倍数
• 创建AES加密器失败
• IV长度不正确: 期望 ，实际

AI-assisted analysis of fish2018/pansou@beaa561337 (2026-09-07). Data as JSON: /api/errors/edcd5b3bdadf95ae. Report an issue: GitHub.

Appendix: source

Thrown at plugin/sdso/sdso.go:420

		return "", fmt.Errorf("创建AES加密器失败: %w", err)
	}

	// 创建CBC模式解密器
	iv := []byte(AESIV)
	if len(iv) != aes.BlockSize {
		return "", fmt.Errorf("IV长度不正确: 期望%d，实际%d", aes.BlockSize, len(iv))
	}

	mode := cipher.NewCBCDecrypter(block, iv)

	// 解密
	plaintext := make([]byte, len(ciphertext))
	mode.CryptBlocks(plaintext, ciphertext)

	// 去除PKCS7填充
	unpaddedText, err := removePKCS7Padding(plaintext)
	if err != nil {
		return "", fmt.Errorf("去除填充失败: %w", err)
	}

	return string(unpaddedText), nil
}

// removePKCS7Padding 去除PKCS7填充
func removePKCS7Padding(data []byte) ([]byte, error) {
	if len(data) == 0 {
		return nil, fmt.Errorf("数据为空")
	}

	// 获取填充长度
	paddingLen := int(data[len(data)-1])

	// 验证填充长度
	if paddingLen == 0 || paddingLen > len(data) || paddingLen > aes.BlockSize {
		return nil, fmt.Errorf("无效的填充长度: %d", paddingLen)
	}

View on GitHub (pinned to beaa561337)