@lingxiteam/ebe-utils 0.0.1

package/lib/public/src/utils/Security/encipher/des.ts

@@ -0,0 +1,52 @@
+import CryptoJS from 'crypto-js';
+import type { fnDESDecryptType, fnDESEncryptType } from '../types';
+
+/**
+ * 默认DES加密处理函数
+ * @param content 待加密内容
+ * @param desKey 密钥
+ * @param handle 自定义加密函数
+ * @returns 加密后内容
+ */
+export const DESEncrypt = (
+  content: string,
+  desKey: string,
+  handle?: fnDESEncryptType,
+): string => {
+  if (typeof handle === 'function') {
+    return handle(content, desKey, CryptoJS);
+  }
+  const key = CryptoJS.enc.Utf8.parse(desKey);
+  const ciphertext = CryptoJS.enc.Utf8.parse(content);
+  const encrypted = CryptoJS.DES.encrypt(ciphertext, key, {
+    mode: CryptoJS.mode.ECB,
+    padding: CryptoJS.pad.Pkcs7,
+  });
+  return encrypted.toString();
+};
+
+/**
+ * 默认AES解密处理函数
+ * @param content 待解密内容
+ * @param desKey 密钥
+ * @param handle 自定义解密函数
+ * @returns 解密后内容
+ */
+export const DESDecrypt = (
+  content: string,
+  desKey: string,
+  handle?: fnDESDecryptType,
+): string => {
+  if (typeof handle === 'function') {
+    return handle(content, desKey, CryptoJS);
+  }
+  const key = CryptoJS.enc.Utf8.parse(desKey);
+  const ciphertext = CryptoJS.enc.Base64.stringify(
+    CryptoJS.enc.Base64.parse(content),
+  );
+  const encrypted = CryptoJS.DES.decrypt(ciphertext, key, {
+    mode: CryptoJS.mode.ECB,
+    padding: CryptoJS.pad.Pkcs7,
+  });
+  return encrypted.toString(CryptoJS.enc.Utf8);
+};

package/lib/public/src/utils/Security/encipher/rsa.ts

@@ -0,0 +1,42 @@
+import JSEncrypt from 'jsencrypt';
+import type { fnRSADecryptType, fnRSAEncryptType } from '../types';
+
+/**
+ * 默认RSA加密处理函数
+ * @param content 待加密内容
+ * @param publicKey 密钥
+ * @param handle 自定义加密函数
+ * @returns 加密后内容
+ */
+export const RSAEncrypt = (
+  content: string,
+  publicKey: string,
+  handle?: fnRSAEncryptType,
+) => {
+  if (typeof handle === 'function') {
+    return handle(content, publicKey, JSEncrypt);
+  }
+  const encryptor = new JSEncrypt();
+  encryptor.setPublicKey(publicKey);
+  return encryptor.encrypt(content);
+};
+
+/**
+ * 默认RSA解密处理函数
+ * @param content 待解密内容
+ * @param privKey 密钥
+ * @param handle 自定义解密函数
+ * @returns 解密后内容
+ */
+export const RSADecrypt = (
+  content: string,
+  privKey: string,
+  handle?: fnRSADecryptType,
+) => {
+  if (typeof handle === 'function') {
+    return handle(content, privKey, JSEncrypt);
+  }
+  const decrypt = new JSEncrypt();
+  decrypt.setPrivateKey(privKey);
+  return decrypt.decrypt(content);
+};

package/lib/public/src/utils/Security/encipher/sign.ts

@@ -0,0 +1,212 @@
+/* eslint-disable no-case-declarations */
+import { SHA256 } from 'crypto-js';
+import { v4 as uuidv4 } from 'uuid';
+import config from '../config';
+import { aesKey, securityHeaderKey, signHeaderKey } from '../const';
+import { MODE, signHttpOptionsType } from '../types';
+import { checkIsSignMode } from '../utils/check';
+import message from '../utils/message';
+import {
+  decodeQueryString,
+  obj2QueryString,
+  removeURLParameters,
+} from '../utils/url';
+import { AESEncrypt } from './aes';
+
+// 注意：修改此文件请跑测试用例, npm run test
+
+// 1、签名算法：
+// 通过对url、参数、秘钥拼接成字符串，然后对字符串使用算法SHA-256得到64个字符串，放到header, X-SIGN=XXXXXXX。
+
+// 2、签名字符串拼接规则：
+// a.get 请求：url+"#"+header+"#"+参数+"#"+秘钥
+// b.post 请求：url+"#"+header+"#"+body+"#"秘钥
+// 参数说明：
+// ● 如果其中的变量为空，则为空字符串。
+// ● url ：不包含参数，(2022.08.08 更改为apiName)
+// ● header ：取X-开头的header，或者APP-ID，多个则逗号分隔拼接。比如X-AA=a;APP-ID=88888
+// ● get 参数：就是url 问号后面的串
+// ● body：post 请求体
+
+/**
+ * 组装X-SIGN请求头
+ * @param {请求地址} url 接口请求地址
+ * @param {请求参数} options
+ * @returns
+ */
+
+// 由于X-B 的规则可能被业务网关使用，并往请求头增加内容，导致前后端加密不一致
+// 2022.08.09 使用以下3个固定值 + X-LX-*匹配 方式
+const hKeys = ['X-B-AUTH', 'X-B-TARGET-ID', 'APP-ID'];
+
+// 获取接口路径,2023-03-16调整，由于网关配置问题可能导致前后端取的服务地址不一致，调整后只取最后一级
+const getApiPath = (url: string) => {
+  return url.split('/').pop();
+};
+
+export const createHttpSignStr = (
+  url: string,
+  options: signHttpOptionsType,
+  version?: any,
+) => {
+  if (!url || !options) {
+    message.warn('签名失败，url地址或参数为空');
+    return '';
+  }
+  if (version && !checkIsSignMode(version)) {
+    message.warn(`不支持[${version}]签名模式`);
+    return '';
+  }
+  const { method = 'GET', headers, body, search, saltValue } = options;
+  const signVersion = version || config.mode;
+
+  // 获取参数1: 接口名称
+  let mixUrl = url;
+  if (search && search instanceof Object) {
+    mixUrl += (url.indexOf('?') !== -1 ? '&' : '?') + obj2QueryString(search);
+  }
+  const [urlPath, urlSearch = ''] = mixUrl.split('?');
+  const apiPath = getApiPath(urlPath);
+
+  // 获取参数2: 请求头部参数
+  let headerParams = '';
+  const headersKeyArr: any = [];
+  if (headers) {
+    Object.keys(headers)
+      .concat(config.sign?.includeHeaders || [])
+      .forEach((key) => {
+        if (key.startsWith('X-LX-') || hKeys.includes(key)) {
+          headersKeyArr.push(`${key.toLowerCase()}=${headers[key]}`);
+        }
+      });
+  }
+  headerParams = headersKeyArr.sort().join(';');
+
+  // 获取参数3: 请求参数
+  let params = '';
+  // body为空时，可能出现前后端取值不一致问题。
+  // nodejs 一般存在空字符串、空对象、undefined、空表单 等，取决于框架处理和使用的中间件
+  // java后端一般为null
+  let finallyBody = body;
+  if (typeof config.emptyBodyValue !== 'undefined') {
+    finallyBody =
+      body === undefined || body === null ? config.emptyBodyValue : body;
+  }
+  if (method.toLowerCase() === 'get') {
+    // 为保证与后端值一致此处需要将数据进行解码
+    params = decodeQueryString(urlSearch);
+  } else {
+    params =
+      typeof finallyBody === 'object'
+        ? JSON.stringify(finallyBody)
+        : finallyBody;
+  }
+
+  // 获取参数4: 用户id, 优先从options.saltValue
+  const getSaltValue = (): string =>
+    typeof config.sign?.saltValue === 'function'
+      ? config.sign.saltValue()
+      : config.sign?.saltValue;
+
+  // 签名内容
+  let content: string = '';
+  // 签名结果
+  let result: string = '';
+  switch (signVersion) {
+    case MODE.SIGN:
+    case MODE.SIGN_KEY:
+      content = [
+        apiPath,
+        headerParams,
+        params,
+        saltValue || getSaltValue(),
+        config.sign?.key,
+      ].join('#');
+      result = SHA256(content).toString();
+      break;
+    case MODE.SIGN_WITH_TIME:
+    case MODE.SIGN_WITHOUT_SALT:
+      // eslint-disable-next-line no-case-declarations
+      const deviation = config.timeDeviation as number;
+      const now = Date.now() - deviation;
+      content = [
+        apiPath,
+        headerParams,
+        params,
+        signVersion === MODE.SIGN_WITHOUT_SALT
+          ? ''
+          : saltValue || getSaltValue(),
+        config.sign?.key,
+        now,
+      ].join('#');
+      result = [SHA256(content).toString(), now, deviation].join('.');
+      break;
+    case MODE.SIGN_UUID:
+    case MODE.SIGN_UUID_WITHOUT_SALT:
+      const uuid = uuidv4();
+      content = [
+        apiPath,
+        headerParams,
+        params,
+        signVersion === MODE.SIGN_UUID_WITHOUT_SALT
+          ? ''
+          : saltValue || getSaltValue(),
+        config.sign?.key,
+        uuid,
+      ].join('#');
+      result = AESEncrypt([SHA256(content).toString(), uuid].join('.'), aesKey);
+      break;
+    default:
+      break;
+  }
+
+  if (config.debug) {
+    message.log(` --- signDebug(${signVersion}) ---`);
+    message.log('url', url);
+    message.log('str', content);
+    message.log('sign', result);
+  }
+
+  // 返回约定签名
+  return result;
+};
+
+// 由于（img、script）无法进行处理请求头，将签名参数x-sign放到url参数里
+export const buildXSignUrl = (
+  url: string,
+  options: signHttpOptionsType = {},
+  version?: any,
+) => {
+  if (!url) {
+    return '';
+  }
+  if (version && !checkIsSignMode(version)) {
+    message.warn(`不支持[${version}]签名模式`);
+    return url;
+  }
+  let _url = url;
+  const signVersion =
+    version || checkIsSignMode(config.mode as MODE)
+      ? config.mode
+      : MODE.SIGN_WITH_TIME;
+  const signStr = createHttpSignStr(
+    url,
+    { method: 'GET', ...options },
+    signVersion,
+  );
+  // 如果url上存在签名则移除原签名
+  if (
+    url.indexOf(signHeaderKey) !== -1 ||
+    url.indexOf(securityHeaderKey) !== -1
+  ) {
+    _url = removeURLParameters(url, [signHeaderKey, securityHeaderKey]);
+  }
+  return `${_url}${
+    _url.includes('?') ? '&' : '?'
+  }${signHeaderKey}=${signStr}&${securityHeaderKey}=${signVersion}`;
+};
+
+// buildXSignUrl兼容平台内部使用，外部使用createHttpSignWithUrl
+export const createHttpSignWithUrl = buildXSignUrl;
+
+export default { createHttpSignStr, createHttpSignWithUrl };

package/lib/public/src/utils/Security/encipher/token.ts

@@ -0,0 +1,52 @@
+import CryptoJS from 'crypto-js';
+import AES from 'crypto-js/aes';
+import encUtf8 from 'crypto-js/enc-utf8';
+import MD5 from 'crypto-js/md5';
+
+const key = 'Lixing666';
+const iv = '3468546098617269';
+
+/**
+ * 生成token
+ * @param salt token里添加的盐值
+ * @returns token
+ */
+const generateToken = (salt: any) => {
+  const tokenStr = `${MD5(salt).toString()}.${new Date().getTime()}`;
+  return AES.encrypt(tokenStr, key, {
+    iv: encUtf8.parse(iv),
+  }).toString();
+};
+
+/**
+ * 校验token合法性
+ * @param token 待校验的token
+ * @param salt token里添加的盐值
+ * @returns 是否合法
+ */
+const checkToken = (token: string, salt: string): boolean => {
+  let result = true;
+  if (token) {
+    const bytes = CryptoJS.AES.decrypt(token, key, {
+      iv,
+    } as any);
+    const decryptedData = bytes.toString(CryptoJS.enc.Utf8);
+    if (decryptedData) {
+      // 加密字符串： MD5(pageId) + '.' + Timestamp + '.' + ‘版本(保留)’
+      const tokenarr = decryptedData.split('.');
+      const pagemd5 = CryptoJS.MD5(salt).toString();
+      // Token验证：第一段相同，且Timestamp和当前时间的差距在1小时（3600秒 = 3600000毫秒）内
+      if (
+        tokenarr.length >= 2 &&
+        tokenarr[0] === pagemd5 &&
+        new Date(parseInt(tokenarr[1], 10)).getTime() - new Date().getTime() <=
+          3600000
+      ) {
+        result = true;
+      }
+    }
+  }
+  return result;
+};
+
+export { checkToken, generateToken };

package/lib/public/src/utils/Security/httpEncryption.ts

@@ -0,0 +1,75 @@
+/*
+ * @Author: 张国永 zhang.guoyong2@iwhalecloud.com
+ * @Date: 2022-08-08 15:08:58
+ * @Description: 一个简单的http请求安全加密处理
+ */
+
+// TODO 支持XMLHttpRequest拦截、参数混淆、响应拦截
+
+// 使用方式1: 使用fetch请求模块，start({ mode: signKey })，适应经过封装的fetch模块
+// 使用方式2: 使用fetch请求模块，将window.fetch 替换成 fetch，适应自己封装的fetch模块
+// 使用方式3: 不使用fetch请求模块，使用createHttpSignStr自己获取签名，自行在header上添加参数
+import merge from 'merge';
+import capabilities from './clientCapabilities';
+import config, { createDefaultConfig, setConfig } from './config';
+import {
+  conflict as conflictFetch,
+  noConflict as noConflictFetch,
+} from './requester/fetch';
+import {
+  conflict as conflictWxRequest,
+  noConflict as noConflictWxRequest,
+} from './requester/wx';
+import {
+  conflict as conflictXHR,
+  noConflict as noConflictXHR,
+} from './requester/xhr';
+import type { configType } from './types';
+import { checkIsModeValue } from './utils/check';
+import message from './utils/message';
+
+let isHttpEncryption = false;
+const noConflictList: Function[] = [];
+
+function start(startConfig?: configType) {
+  if (isHttpEncryption) {
+    message.warn('安全模式已开启,请使用stop方法停止后再重新开启');
+    return true;
+  }
+
+  const _startConfig = merge.recursive({}, createDefaultConfig(), startConfig);
+
+  const mode = _startConfig.mode as string;
+  if (checkIsModeValue(mode)) {
+    isHttpEncryption = true;
+    // 设置
+    setConfig(_startConfig);
+
+    // 按需启动请求劫持
+    if (capabilities.fetch && config.requester?.includes('fetch')) {
+      conflictFetch();
+      noConflictList.push(noConflictFetch);
+    }
+    if (capabilities.xhr && config.requester?.includes('xhr')) {
+      conflictXHR();
+      noConflictList.push(noConflictXHR);
+    }
+    if (capabilities.wxRequest && config.requester?.includes('wxRequest')) {
+      conflictWxRequest();
+      noConflictList.push(noConflictWxRequest);
+    }
+  } else {
+    message.error(`http安全开启失败,不支持${mode}模式`);
+  }
+
+  return isHttpEncryption;
+}
+
+function stop() {
+  isHttpEncryption = false;
+  noConflictList.forEach((noConflict) => {
+    noConflict();
+  });
+}
+
+export default { start, stop };

package/lib/public/src/utils/Security/index.ts

@@ -0,0 +1,28 @@
+import { setConfig } from './config';
+import KEYS from './const';
+import { AESDecrypt, AESEncrypt } from './encipher/aes';
+import { DESDecrypt, DESEncrypt } from './encipher/des';
+import { RSADecrypt, RSAEncrypt } from './encipher/rsa';
+import { createHttpSignStr, createHttpSignWithUrl } from './encipher/sign';
+import { checkToken, generateToken } from './encipher/token';
+import httpEncryption from './httpEncryption';
+import { lxEncrypt } from './utils/encrypted';
+
+const security = {
+  httpEncryption,
+  createHttpSignStr,
+  createHttpSignWithUrl,
+  RSAEncrypt,
+  RSADecrypt,
+  AESEncrypt,
+  AESDecrypt,
+  DESEncrypt,
+  DESDecrypt,
+  KEYS,
+  checkToken,
+  generateToken,
+  setConfig,
+  lxEncrypt,
+};
+
+export default security;

package/lib/public/src/utils/Security/requester/fetch.ts

@@ -0,0 +1,119 @@
+import capabilities from '../clientCapabilities';
+import config from '../config';
+import { createHttpSignStr } from '../encipher/sign';
+import {
+  checkIsEncryption,
+  checkIsSignMode,
+  checkIsUrlIgnore,
+} from '../utils/check';
+import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
+import message from '../utils/message';
+
+const originRequester: any = capabilities.fetch
+  ? (window || globalThis).fetch
+  : undefined;
+
+const fetch = (url: any, fetchOptions: any = {}): Promise<any> => {
+  let requester: Promise<any>;
+  const opts = { ...fetchOptions };
+
+  // 判定是否符合忽略规则
+  if (checkIsUrlIgnore(url, opts)) {
+    return originRequester(url, opts);
+  }
+
+  // 请求头配置
+  // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
+  // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
+  // headers[securityHeaderKey] 指定当前服务安全模式
+  const securityHeaderKey = config.securityHeaderKey as string;
+  const modeInHeadParam = (opts.headers || {})[securityHeaderKey];
+
+  // 优先使用当前请求头指定的安全模式
+  const finallyMode = modeInHeadParam || config.mode;
+
+  // 通过请求头参数关闭当次安全模式
+  if (
+    String(modeInHeadParam) === 'false' ||
+    opts.headers?.disabledSignKey === true ||
+    opts.headers?.disabledEncrypted === true ||
+    finallyMode === false
+  ) {
+    // 不能直接删除，否则会导致disabledSignKey 这个节点删除了，第二次进来的时候导致异常
+    // const { disabledSignKey, ...resprops } = opts?.headers;
+    const _cloneHeader = Object.assign({}, opts.headers);
+    delete _cloneHeader.disabledSignKey;
+    delete _cloneHeader.disabledEncrypted;
+    delete _cloneHeader[securityHeaderKey];
+    requester = originRequester(url, { ...opts, headers: { ..._cloneHeader } });
+  } else if (checkIsSignMode(finallyMode)) {
+    // ------ 参数签名(默认) ------
+    const signValueKeyName = config.sign?.valueKeyName as string;
+    opts.headers = {
+      [securityHeaderKey]: finallyMode,
+      ...opts.headers,
+      [signValueKeyName]: createHttpSignStr(url, fetchOptions, finallyMode),
+    };
+    requester = originRequester(url, opts);
+  } else if (checkIsEncryption(finallyMode)) {
+    // ------ 参数加密 ------
+    // search和body加密
+    const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
+      url,
+      opts,
+      finallyMode,
+    );
+
+    requester = originRequester(encryptedUrl, encryptedOpts);
+  } else {
+    // 其他
+    requester = originRequester(url, opts);
+  }
+
+  // ------ 响应解密 ------
+  return requester.then(async (response: Response) => {
+    const securityType = response.headers.get(securityHeaderKey);
+
+    if (securityType && checkIsEncryption(securityType) && response.body) {
+      // 响应数据
+      const respResult = await response.text();
+
+      // 解密数据
+      let result;
+      try {
+        result = decryptedStr(respResult, securityType, config);
+      } catch (e) {
+        message.error('--------解密失败--------');
+        // message.error(`请求ID：${reqId}`);
+        message.error(`请求地址：${url}`);
+        message.error(`解密方式：${securityType}`);
+        message.error(`解密报文：${respResult}`);
+        message.error(`失败原因：${e}`);
+        return new Response(null, { status: 400, statusText: String(e) });
+      }
+
+      // 覆盖响应值
+      let json;
+      try {
+        json = JSON.parse(result);
+      } catch (e) {
+        json = result;
+        message.warn(`响应报文转换JSON失败, 内容为 ${result}`);
+      }
+      const blob = new Blob([JSON.stringify(json, null, 2)], {
+        type: 'application/json',
+      });
+      return new Response(blob);
+    }
+    return response;
+  });
+};
+
+export const conflict = () => {
+  (window || globalThis).fetch = fetch;
+};
+export const noConflict = () => {
+  (window || globalThis).fetch = originRequester;
+};
+
+export default fetch;