Skip to content

fix(wecom): fix media file/image receiving issues#17040

Closed
chengoak wants to merge 1 commit into
NousResearch:mainfrom
chengoak:main
Closed

fix(wecom): fix media file/image receiving issues#17040
chengoak wants to merge 1 commit into
NousResearch:mainfrom
chengoak:main

Conversation

@chengoak

@chengoak chengoak commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Fixes two WeCom media receiving issues:

1. AES key base64 padding missing issue

  • Problem: WeCom doesn't pad base64 aeskey with '=', causing Python strict mode decode failure
  • Fix: Add automatic padding:

2. WeCom COS domain SSRF blocking issue

  • Problem: resolves to 198.18.x.x (IANA reserved range), which was being blocked by SSRF protection
  • Fix: Add the WeCom COS domain to whitelist

Both fixes have been tested and verified working on WeCom private chat.

@chengoak
fix(wecom): fix media file/image receiving issues
2e52c33 
1. Fix AES key base64 padding missing issue
   - WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
   - Add automatic padding: aeskey + '=' * ((4 - len(aeskey) % 4) % 4)

2. Add WeCom COS domain to SSRF trusted hosts whitelist
   - ww-aibot-img-1258476243.cos.ap-guangzhou.myqcloud.com resolves to 198.18.x.x
   - This IANA reserved range was being blocked by SSRF protection
@alt-glitch alt-glitch added type/bug Something isn't working P2 Medium — degraded but workaround exists comp/gateway Gateway runner, session dispatch, delivery platform/wecom WeCom / WeChat Work adapter labels Apr 28, 2026
@alt-glitch

alt-glitch commented Apr 28, 2026

Copy link
Copy Markdown
Collaborator

Partially overlaps with #14580 (same aeskey base64 padding fix) and #10085 (same two bugs reported). This PR also adds the SSRF whitelist for WeCom COS domain.

@chengoak

chengoak commented Apr 28, 2026

Copy link
Copy Markdown
Contributor Author

说明：main 分支 Tests 当前状态

提交此 PR 时，main 分支的 Tests workflow 本身就是失败状态（最近的 push #25057684173 失败）。

main 分支的测试失败与本 PR 无关，主要是以下问题：

  • normalize_whatsapp_identifier 导入失败（tests/gateway/test_session.py）
  • Anthropic beta header 断言不匹配（新增了 context-1m-2025-08-07）
  • npm install vs ci 命令断言不一致（test_cmd_update.py）
  • _warn_stale_dashboard_processes 类型错误
  • Chrome CDP 启动超时（CI 基础设施问题）

本 PR 的修改范围仅限：

  1. gateway/platforms/wecom.py - 添加媒体消息调试日志 + 修复 AES key base64 padding
  2. tools/url_safety.py - 添加 WeCom COS 域名到白名单

这些修改不会影响上述失败的测试。请审核合并，谢谢！ 🙏

@chengoak

chengoak commented Apr 28, 2026

Copy link
Copy Markdown
Contributor Author

感谢 @alt-glitch 指出！👍

确实，这个 PR 包含了与 #14580 相同的 AES key base64 padding 修复，同时还额外添加了：

  1. WeCom 媒体文件接收的调试日志（方便后续排查问题）
  2. WeCom COS 域名（）到 SSRF 白名单（修复图片/文件下载被安全策略拦截的问题）

如果 #14580 先合并，我可以后续 rebase 这个 PR，只保留新增的日志和 SSRF 白名单部分。或者如果这个 PR 更合适，我也可以随时调整。

请告知哪种方式更方便，谢谢！

@chengoak

chengoak commented Apr 30, 2026

Copy link
Copy Markdown
Contributor Author

Hi @alt-glitch, 请问这个 PR 可以合并了吗？主要修复了企业微信接收媒体文件/图片的问题。谢谢！🙏

@teknium1 teknium1 mentioned this pull request May 5, 2026
Merged
teknium1 pushed a commit that referenced this pull request May 5, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
f07bfc5 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR #17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
teknium1 pushed a commit that referenced this pull request May 5, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
31eadb5 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR #17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
teknium1 pushed a commit that referenced this pull request May 5, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
8f4c0bf 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR #17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
nickdlkk pushed a commit to nickdlkk/hermes-agent that referenced this pull request May 11, 2026
@chengoak @nickdlkk
fix(wecom): pad base64 AES key before decode
23790b8 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR NousResearch#17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
rmulligan pushed a commit to rmulligan/hermes-agent that referenced this pull request May 11, 2026
@chengoak
fix(wecom): pad base64 AES key before decode
ef3cb34 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR NousResearch#17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
JinyuID pushed a commit to JinyuID/hermes-agent that referenced this pull request May 11, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
4eb3af5 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR NousResearch#17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
02356abc pushed a commit to 02356abc/hermes-agent that referenced this pull request May 14, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
e9dec29 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR NousResearch#17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
jsboige pushed a commit to jsboige/hermes-agent that referenced this pull request May 14, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
833acfd 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR NousResearch#17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
gweeteve pushed a commit to gweeteve/hermes-agent that referenced this pull request Jun 2, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
73e145c 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR NousResearch#17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
Egavasyug pushed a commit to Egavasyug/hermes-agent that referenced this pull request Jun 10, 2026
@chengoak @teknium1
fix(wecom): pad base64 AES key before decode
8b1db34 
WeCom doesn't pad base64 aeskey, causing Python strict mode decode failure
on media/image/file messages. Add automatic padding before base64 decode:
aes_key + '=' * ((4 - len(aes_key) % 4) % 4).

Salvages the AES padding fix from @chengoak's PR NousResearch#17040. The SSRF whitelist
entry for a private COS bucket hostname was dropped as it belongs in user
config, not the built-in trusted-private-IP-hosts list. The debug-level
full-body info log was dropped to avoid logging potentially sensitive
message content at INFO level.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

comp/gateway Gateway runner, session dispatch, delivery P2 Medium — degraded but workaround exists platform/wecom WeCom / WeChat Work adapter type/bug Something isn't working

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@chengoak @alt-glitch