@lingxiteam/ebe-utils 0.0.1

package/lib/public/src/utils/Security/requester/wx.ts

@@ -0,0 +1,132 @@
+import capabilities from '../clientCapabilities';
+import config from '../config';
+import { createHttpSignStr } from '../encipher/sign';
+import {
+  checkIsEncryption,
+  checkIsSignMode,
+  checkIsSignWithSalt,
+  checkIsUrlIgnore,
+} from '../utils/check';
+import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
+
+const originRequester: any = capabilities.wxRequest ? wx.request : undefined;
+
+const wxRequest = (
+  option: WechatMiniprogram.RequestOption,
+): WechatMiniprogram.RequestTask => {
+  const opts = { ...option };
+  // 判定是否符合忽略规则
+  if (
+    checkIsUrlIgnore(opts.url, {
+      headers: opts.header,
+      body: opts.data,
+      method: opts.method,
+    })
+  ) {
+    return originRequester(opts);
+  }
+
+  let requester;
+  // 请求头配置
+  // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
+  // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
+  // headers[securityHeaderKey] 指定当前服务安全模式
+  const securityHeaderKey = config.securityHeaderKey as string;
+  const modeInHeadParam = (opts.header || {})[securityHeaderKey];
+
+  // 优先使用当前请求头指定的安全模式
+  const finallyMode = modeInHeadParam || config.mode;
+
+  // 拦截success，处理解密
+  const originSuccess = opts.success;
+  if (originSuccess) {
+    const success: WechatMiniprogram.RequestSuccessCallback = (response) => {
+      const securityType = response.header[securityHeaderKey];
+      if (checkIsEncryption(securityType)) {
+        let result;
+        try {
+          if (typeof response.data === 'string') {
+            result = decryptedStr(response.data, securityType, config);
+            if (response.header['content-type'] === 'application/json') {
+              result = JSON.parse(result);
+            }
+          }
+        } finally {
+          response.data =
+            typeof result === 'undefined' ? response.data : result;
+        }
+      }
+      originSuccess(response);
+    };
+    opts.success = success;
+  }
+
+  // 通过请求头参数关闭当次安全模式
+  if (
+    String(modeInHeadParam) === 'false' ||
+    opts.header?.disabledSignKey === true ||
+    opts.header?.disabledEncrypted === true ||
+    finallyMode === false
+  ) {
+    // 不能直接删除，否则会导致disabledSignKey 这个节点删除了，第二次进来的时候导致异常
+    // const { disabledSignKey, ...resprops } = opts?.headers;
+    const _cloneHeader = Object.assign({}, opts.header);
+    delete _cloneHeader.disabledSignKey;
+    delete _cloneHeader.disabledEncrypted;
+    delete _cloneHeader[securityHeaderKey];
+    requester = originRequester({ ...opts, header: { ..._cloneHeader } });
+  } else if (checkIsSignMode(finallyMode)) {
+    // ------ 参数签名(默认) ------
+    const signValueKeyName = config.sign?.valueKeyName as string;
+    opts.header = {
+      ...(opts.header || {}),
+      [securityHeaderKey]: finallyMode,
+      [signValueKeyName]: createHttpSignStr(
+        opts.url,
+        { method: opts.method, body: opts.data },
+        finallyMode,
+      ),
+    };
+    // 后端根据cookie里的值进行校验
+    if (checkIsSignWithSalt(finallyMode)) {
+      const saltValue =
+        typeof config.sign?.saltValue === 'function'
+          ? config.sign?.saltValue()
+          : config.sign?.saltValue;
+      opts.header.Cookie = opts.header.Cookie
+        ? `${opts.header.Cookie};${config.sign?.saltKey}=${saltValue}`
+        : `${config.sign?.saltKey}=${saltValue}`;
+    }
+    requester = originRequester(opts);
+  } else if (checkIsEncryption(finallyMode)) {
+    // ------ 参数加密 ------
+    // search和body加密
+    const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
+      opts.url,
+      { body: opts.data, headers: opts.header },
+      finallyMode,
+    );
+    opts.url = encryptedUrl;
+    if (encryptedOpts.body) {
+      opts.data = encryptedOpts.body;
+    }
+    if (encryptedOpts.headers) {
+      opts.header = encryptedOpts.headers;
+    }
+    requester = originRequester(encryptedUrl, encryptedOpts);
+  } else {
+    // 其他
+    requester = originRequester(opts);
+  }
+
+  return requester;
+};
+
+export const conflict = () => {
+  wx.request = wxRequest;
+};
+export const noConflict = () => {
+  wx.request = originRequester;
+};
+
+export default wxRequest;

package/lib/public/src/utils/Security/requester/xhr.ts

@@ -0,0 +1,121 @@
+import config from '../config';
+// import { checkIsSignMode, checkIsEncryption, checkIsUrlIgnore, checkIsSignWithSalt } from '../utils/check';
+import { createHttpSignStr } from '../encipher/sign';
+import { checkIsUrlIgnore } from '../utils/check';
+// import { encryptedRequestParams, decryptedStr } from '../utils/encrypted';
+import capabilities from '../clientCapabilities';
+
+const originRequester: any = capabilities.xhr ? XMLHttpRequest : undefined;
+
+// 从请求头中获取参数
+function getRequestHeaders(xhr: XMLHttpRequest) {
+  const headers: any = {};
+  xhr
+    .getAllResponseHeaders()
+    .split('\n')
+    .forEach((header) => {
+      const [key, value] = header.split(': ');
+      headers[key] = value;
+    });
+  return headers;
+}
+
+const xhr = function () {
+  // eslint-disable-next-line new-cap
+  const originXhr = new originRequester();
+
+  const securityHeaderKey = config.securityHeaderKey as string;
+  const signValueKeyName = config.sign?.valueKeyName as string;
+
+  let finallyMode: any = config.mode;
+  let xhrUrl: string = '';
+  let xhrMethod: any = '';
+
+  // 用于存储请求头信息
+  const requestHeaders: any = {};
+
+  // 劫持 open 方法
+  const originalOpen = originXhr.open;
+  originXhr.open = function (
+    method: string,
+    url: string,
+    async?: boolean,
+    user?: string,
+    password?: string,
+  ) {
+    // 记录url地址
+    xhrUrl = url;
+    xhrMethod = method;
+    // 获取请求头中的参数
+    const _requestHeaders = getRequestHeaders(originXhr);
+    Object.assign(requestHeaders, _requestHeaders);
+    // 调用原始的 open 方法
+    originalOpen.call(this, method, url, async, user, password);
+  };
+
+  // 劫持 setRequestHeader 方法
+  const originalSetRequestHeader = originXhr.setRequestHeader;
+  originXhr.setRequestHeader = function (
+    key: string,
+    value: string | number | boolean,
+  ) {
+    // 记录请求头信息
+    requestHeaders[key] = value;
+
+    // 调用原始的 setRequestHeader 方法
+    originalSetRequestHeader.call(this, key, value);
+  };
+
+  // 劫持 send 方法
+  const originalSend = originXhr.send;
+  originXhr.send = function (data: any) {
+    // 判定是否符合忽略规则
+    if (
+      checkIsUrlIgnore(xhrUrl, {
+        headers: requestHeaders,
+        body: data,
+        method: xhrMethod,
+      })
+    ) {
+      originalSend.call(this, data);
+      return;
+    }
+
+    // 获取请求头信息
+    const requestHeadersSnapshot = { ...requestHeaders };
+
+    // 优先使用请求头自带的模式
+    if (requestHeadersSnapshot[securityHeaderKey]) {
+      finallyMode = requestHeadersSnapshot[securityHeaderKey];
+    }
+
+    // 签名并添加额外的参数
+    originalSetRequestHeader.call(this, securityHeaderKey, finallyMode);
+    originalSetRequestHeader.call(
+      this,
+      signValueKeyName,
+      createHttpSignStr(
+        xhrUrl,
+        { method: xhrMethod, headers: requestHeadersSnapshot, body: data },
+        finallyMode,
+      ),
+    );
+
+    // 修改请求 URL
+    //  originXhr.open(originXhr.method, url, originXhr.async, originXhr.username, originXhr.password);
+
+    // 调用原始的 send 方法
+    originalSend.call(this, data);
+  };
+
+  return originXhr;
+};
+
+export const conflict = () => {
+  (window as any).XMLHttpRequest = xhr;
+};
+export const noConflict = () => {
+  (window as any).XMLHttpRequest = originRequester;
+};
+
+export default xhr;

package/lib/public/src/utils/Security/types.ts

@@ -0,0 +1,181 @@
+type requester = 'fetch' | 'xhr' | 'wxRequest';
+
+export const enum MODE {
+  // 参数签名(旧数据)
+  SIGN_KEY = 'signKey',
+  // 参数签名
+  SIGN = '1.0',
+  // 时间限制性签名
+  SIGN_WITH_TIME = '1.1',
+  // 时间限制性签名(不带盐-用户信息)
+  SIGN_WITHOUT_SALT = '1.1.1',
+  // 唯一限制性签名
+  SIGN_UUID = '1.2',
+  // 唯一限制性签名(不带盐-用户信息)
+  SIGN_UUID_WITHOUT_SALT = '1.2.1',
+  // RSA参数加密
+  RSA = '2.0',
+  // AES参数加密
+  AES = '3.0',
+  // DES参数加密
+  DES = '4.0',
+}
+
+// 自定义加解密函数
+type EncryptionFunctionType = (
+  content: string,
+  key: string,
+  CryptoJS: CryptoJS,
+) => string;
+
+export type fnDESEncryptType = EncryptionFunctionType;
+
+export type fnDESDecryptType = EncryptionFunctionType;
+
+export type fnAESEncryptType = EncryptionFunctionType;
+
+export type fnAESDecryptType = EncryptionFunctionType;
+
+export type fnRSAEncryptType = (
+  content: string,
+  publicKey: string,
+  JSEncrypt: JSEncrypt,
+) => string;
+
+export type fnRSADecryptType = (
+  content: string,
+  privKey: string,
+  JSEncrypt: JSEncrypt,
+) => string;
+
+export declare namespace encipherOptionType {
+  interface sign {
+    key?: string;
+    saltKey?: string;
+    saltValue?: string | Function;
+    valueKeyName?: string;
+    includeHeaders?: string[];
+  }
+  interface aes {
+    key?: string;
+    encrypt?: fnAESEncryptType;
+    decrypt?: fnAESDecryptType;
+  }
+
+  interface des {
+    key?: string;
+    encrypt?: fnDESEncryptType;
+    decrypt?: fnDESDecryptType;
+  }
+
+  interface rsa {
+    privKey?: string;
+    publicKey?: string;
+    encrypt?: fnRSAEncryptType;
+    decrypt?: fnRSADecryptType;
+  }
+}
+
+type ignoreSupportType = string | RegExp | Function;
+export interface configType {
+  mode?: MODE;
+  securityHeaderKey?: string;
+  requester?: requester | requester[];
+  ignore?: ignoreSupportType | ignoreSupportType[];
+  sign?: encipherOptionType.sign;
+  aes?: encipherOptionType.aes;
+  des?: encipherOptionType.des;
+  rsa?: encipherOptionType.rsa;
+  timeDeviation?: number;
+  debug?: boolean;
+  serverTime?: number | null;
+  keyEncrypt?: boolean;
+  emptyBodyValue?: any;
+}
+
+export interface signHttpOptionsType {
+  method?:
+    | 'OPTIONS'
+    | 'GET'
+    | 'HEAD'
+    | 'POST'
+    | 'PUT'
+    | 'DELETE'
+    | 'TRACE'
+    | 'CONNECT';
+  headers?: any;
+  body?: any;
+  search?: string | any;
+  saltValue?: string;
+}
+
+namespace securityType {
+  export interface httpEncryption {
+    start: (startConfig?: configType) => void;
+    stop: () => void;
+  }
+
+  export function createHttpSignStr(
+    url: string,
+    options: signHttpOptionsType,
+    version?: any,
+  ): string;
+
+  export function createHttpSignWithUrl(
+    url: string,
+    options?: signHttpOptionsType,
+    version?: any,
+  ): string;
+
+  export function RSAEncrypt(
+    content: string,
+    publicKey: string,
+    handle?: fnRSAEncryptType,
+  ): string;
+
+  export function RSADecrypt(
+    content: string,
+    privKey: string,
+    handle?: fnRSADecryptType,
+  ): string;
+
+  export function AESEncrypt(
+    content: string,
+    aesKey: string,
+    handle?: fnAESEncryptType,
+  ): string;
+
+  export function AESDecrypt(
+    content: string,
+    aesKey: string,
+    handle?: fnAESDecryptType,
+  ): string;
+
+  export function DESEncrypt(
+    content: string,
+    desKey: string,
+    handle?: fnDESEncryptType,
+  ): string;
+
+  export function DESDecrypt(
+    content: string,
+    desKey: string,
+    handle?: fnDESDecryptType,
+  ): string;
+
+  export function setConfig(config: configType): void;
+
+  export function lxEncrypt(str: string): string;
+
+  export type httpEncryptionConfigType = typeof configType;
+
+  export type KEYS = {
+    signKey: string;
+    rsaPublicKey: string;
+    rsaPrivKey: string;
+    aesKey: string;
+    desKey: string;
+  };
+}
+
+export default securityType;

package/lib/public/src/utils/Security/utils/check.ts

@@ -0,0 +1,62 @@
+import config from '../config';
+import { MODE } from '../types';
+
+const signModes: string[] = [
+  MODE.SIGN,
+  MODE.SIGN_KEY,
+  MODE.SIGN_UUID,
+  MODE.SIGN_UUID_WITHOUT_SALT,
+  MODE.SIGN_WITHOUT_SALT,
+  MODE.SIGN_WITH_TIME,
+];
+const signModesWithSalt: string[] = [
+  MODE.SIGN,
+  MODE.SIGN_KEY,
+  MODE.SIGN_UUID,
+  MODE.SIGN_WITH_TIME,
+];
+const encryptionModes: string[] = [MODE.AES, MODE.DES, MODE.RSA];
+
+export const checkIsSignMode = (mode: string): boolean => {
+  return signModes.includes(mode);
+};
+
+export const checkIsSignWithSalt = (mode: string): boolean => {
+  return signModesWithSalt.includes(mode);
+};
+
+export const checkIsEncryption = (mode: string): boolean => {
+  return encryptionModes.includes(mode);
+};
+
+export const checkIsModeValue = (mode: string): boolean => {
+  return signModes.includes(mode) || encryptionModes.includes(mode);
+};
+
+export const checkIsUrlIgnore = (
+  url: string,
+  options?: { headers?: any; body?: any; method?: string },
+): boolean => {
+  let isIgnore: boolean = false;
+  if (config.ignore) {
+    const testIsIgnore = (item: string | RegExp | Function): boolean => {
+      if (typeof item === 'string') {
+        return url === item;
+      }
+      if (Object.prototype.toString.call(item) === '[object RegExp]') {
+        return (item as RegExp).test(url);
+      }
+      if (typeof item === 'function') {
+        return item(url, options);
+      }
+      return false;
+    };
+
+    if (Array.isArray(config.ignore)) {
+      isIgnore = config.ignore.map((item) => testIsIgnore(item)).includes(true);
+    } else {
+      isIgnore = testIsIgnore(config.ignore);
+    }
+  }
+  return isIgnore;
+};

package/lib/public/src/utils/Security/utils/cookie.ts

@@ -0,0 +1,70 @@
+import capabilities from '../clientCapabilities';
+import message from './message';
+
+const showError = () => message.warn('[lcdp-security]: 当前环境不支持cookie');
+
+const CookieUtil = {
+  get(name: string) {
+    if (!capabilities.cookie) {
+      showError();
+      return null;
+    }
+    const cookieName: string = `${encodeURIComponent(name)}=`;
+    const cookieStart: number = document.cookie.indexOf(cookieName);
+    let cookieValue: string | null = null;
+    let cookieEnd: number;
+
+    if (cookieStart > -1) {
+      cookieEnd = document.cookie.indexOf(';', cookieStart);
+      if (cookieEnd === -1) {
+        cookieEnd = document.cookie.length;
+      }
+      cookieValue = decodeURIComponent(
+        document.cookie.substring(cookieStart + cookieName.length, cookieEnd),
+      );
+    }
+
+    return cookieValue;
+  },
+
+  set(
+    name: string,
+    value: string,
+    expires: Date,
+    path: string,
+    domain: string,
+    secure: boolean,
+  ) {
+    if (!capabilities.cookie) {
+      showError();
+      return;
+    }
+    let cookieText = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+
+    if (expires instanceof Date) {
+      cookieText += `; expires=${expires.toUTCString()}`;
+    }
+
+    if (path) {
+      cookieText += `; path=${path}`;
+    }
+
+    if (domain) {
+      cookieText += `; domain=${domain}`;
+    }
+
+    if (secure) {
+      cookieText += '; secure';
+    }
+
+    document.cookie = cookieText;
+  },
+
+  unset(name: string, path: string, domain: string, secure: boolean) {
+    this.set(name, '', new Date(0), path, domain, secure);
+  },
+};
+
+export const getSaltValue = (saltKey: string) => CookieUtil.get(saltKey);
+
+export default CookieUtil;

package/lib/public/src/utils/Security/utils/encrypted.ts

@@ -0,0 +1,122 @@
+import config from '../config';
+import { lxKey } from '../const';
+import { AESDecrypt, AESEncrypt } from '../encipher/aes';
+import { RSADecrypt, RSAEncrypt } from '../encipher/rsa';
+import { MODE } from '../types';
+import message from './message';
+
+export function lxEncrypt(str: string) {
+  if (config.keyEncrypt) {
+    return AESEncrypt(str, lxKey) || str;
+  }
+  return str;
+}
+
+function lxDecrypt(str: string) {
+  if (config.keyEncrypt) {
+    return AESDecrypt(str, lxKey) || str;
+  }
+  return str;
+}
+
+export function encryptedStr(str: string, type: string): string {
+  if (type === MODE.AES) {
+    return AESEncrypt(
+      str,
+      lxDecrypt(config.aes?.key as string),
+      config.aes?.encrypt,
+    );
+  }
+  if (type === MODE.RSA) {
+    return (
+      RSAEncrypt(
+        str,
+        lxDecrypt(config.rsa?.publicKey as string),
+        config.rsa?.encrypt,
+      ) || ''
+    );
+  }
+  if (type === MODE.DES) {
+    message.warn('DES encryption is no longer supported');
+  }
+  return str;
+}
+
+export function decryptedStr(
+  str: string,
+  type: string,
+  config: any = {},
+): string {
+  if (type === MODE.AES) {
+    return AESDecrypt(
+      str,
+      lxDecrypt(config.aes?.key as string),
+      config.aes?.decrypt,
+    );
+  }
+  if (type === MODE.RSA) {
+    return (
+      RSADecrypt(
+        str,
+        lxDecrypt(config.rsa?.privKey as string),
+        config.rsa?.decrypt,
+      ) || ''
+    );
+  }
+  if (type === MODE.DES) {
+    message.warn('DES encryption is no longer supported');
+  }
+  return str;
+}
+
+interface optsType {
+  body?: any;
+  headers?: any;
+}
+type returnType = [string, { body?: any; headers?: any }];
+
+// 统一请求参数加密
+export const encryptedRequestParams = (
+  url: string,
+  opts: optsType,
+  type: string,
+): returnType => {
+  const isFormData = opts.body instanceof FormData;
+
+  // search 部分加密
+  const encryptedUrl =
+    url.indexOf('?') !== -1
+      ? url.replace(/[^?]+$/g, (search: string) => {
+          const params = search.split('&').map((param) => {
+            const [k, v] = param.split('=');
+            return `${encodeURIComponent(k)}=${encodeURIComponent(
+              encryptedStr(v, type),
+            )}`;
+          });
+          return params.join('&');
+        })
+      : url;
+
+  // body参数加密
+  const encryptedOpts = Object.assign({}, opts);
+  encryptedOpts.headers = {
+    ...(opts.headers || {}),
+    [config.securityHeaderKey as string]: type,
+  };
+
+  if (isFormData) {
+    // formData 加密
+    const formData = new FormData();
+    const reqBody = opts.body;
+    for (const key of (reqBody as any).keys()) {
+      const value = reqBody.get(key);
+      formData.append(key, encryptedStr(value, type));
+    }
+    encryptedOpts.body = formData;
+  } else if (opts.body) {
+    //  文本加密
+    encryptedOpts.body = encryptedStr(opts.body, type);
+  }
+
+  return [encryptedUrl, encryptedOpts];
+};

package/lib/public/src/utils/Security/utils/message.ts

@@ -0,0 +1,17 @@
+/* eslint-disable no-console */
+
+const prefixNameSapce = '[lcdp-security]';
+
+const message = {
+  log: (...args: any) => {
+    console.log(prefixNameSapce, ...args);
+  },
+  warn: (...args: any) => {
+    console.warn(prefixNameSapce, ...args);
+  },
+  error: (...args: any) => {
+    console.error(prefixNameSapce, ...args);
+  },
+};
+
+export default message;