企业微信API回调验签错误 #3756 - #3759
Merged
binarywang merged 2 commits intoNov 12, 2025
Hidden character warning
The head ref may contain hidden characters: "\u4f01\u4e1a\u5fae\u4fe1API\u56de\u8c03\u9a8c\u7b7e\u9519\u8bef-#3756"
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
我找到了 WxCryptUtil.decrypt 函数，并对其进行了加固，通过在切片之前验证解密后的有效载荷长度，避免了 Arrays.copyOfRange 函数抛出的 IllegalArgumentException 异常。如果数据格式错误（通常是由于 EncodingAESKey 错误或密文损坏），现在会抛出一个清晰的 WxRuntimeException 异常，而不是像之前那样抛出“20 > …”的错误。 构建和测试： 重新构建项目并重试回调验证；现在你应该会得到解密成功的结果，或者一个清晰、可操作的错误信息，而不是 IllegalArgumentException 异常。 我在 WxCryptUtil.decrypt 函数中添加了强大的长度检查，以防止运行时崩溃，并在密钥/密文错误时提供精确的错误消息。
Copy link
Copy Markdown
Contributor
Author
|
请查看拉取请求。 |
Sorry, something went wrong.
Closed
Copy link
Copy Markdown
There was a problem hiding this comment.
Pull Request Overview
此 PR 修复了企业微信 API 回调验签过程中 WxCryptUtil.decrypt 方法可能抛出的 IllegalArgumentException 异常问题。
主要改进：
- 在数据切片前增加长度验证，避免 Arrays.copyOfRange 参数异常
- 提供更清晰的错误消息，指出可能的根本原因（错误的密文或 EncodingAESKey）
- 增强代码鲁棒性，防止因数据格式错误导致的运行时崩溃
Sorry, something went wrong.
Comment thread
weixin-java-common/src/main/java/me/chanjar/weixin/common/util/crypto/WxCryptUtil.java
Outdated
…/crypto/WxCryptUtil.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
我找到了 WxCryptUtil.decrypt 函数，并对其进行了加固，通过在切片之前验证解密后的有效载荷长度，避免了 Arrays.copyOfRange 的 IllegalArgumentException 异常。如果数据格式错误（通常是由于 EncodingAESKey 错误或密文损坏），现在会抛出一个清晰的 WxRuntimeException 异常，而不是像之前那样抛出“20 > …”的错误。
构建和测试：
重新构建项目并重试回调验证；现在你应该会得到解密成功的结果，或者一个清晰、可操作的错误信息，而不是 IllegalArgumentException 异常。
我在 WxCryptUtil.decrypt 函数中添加了强大的长度检查，以防止运行时崩溃，并在密钥/密文错误时提供精确的错误消息。
如果仍然遇到“签名校验失败”或新的“数据格式非法”错误：
请确保以下三项完全匹配：token、时间戳、nonce 和确切的 Encrypt 值。
请验证您的 EncodingAESKey 是否适用于您的应用：
WeCom 自建应用：使用 corpId
第三方套件：使用 suiteId
请确保您根据不同的场景传递正确的 receiveid，并且传递的 token/EncodingAESKey 与 WeCom 控制台中配置的 token/EncodingAESKey 一致。