@lingxiteam/ebe-utils 0.0.33 → 0.0.35

package/lib/public/src/utils/Security/debug/data.ts

@@ -0,0 +1,86 @@
+import { commonGlobal } from '../const';
+import message from '../utils/message';
+import generateRandomNumber from '../utils/random';
+
+export type configTpe = {
+  globalAccess?: boolean;
+  storeMax?: number;
+};
+
+/**
+ * 存储每个请求的签名/加密数据
+ * 目前仅支持通过localStorage来开启数据记录，避免误将setConfig设置的debug发到生产环境
+ * 通过拷贝请求头里获取 reqid,在控制台粘贴该信息进行查看调试数据
+ */
+class DebugDataStore {
+  private tag: string = '';
+
+  private config: configTpe = {};
+
+  private data: Record<string, any> = {};
+
+  private storeAllKeys: string[] = [];
+
+  private storeActiveKeys: string[] = [];
+
+  constructor(config: configTpe = {}) {
+    this.config = Object.assign(
+      {
+        globalAccess: true,
+        storeMax: 20,
+      },
+      config,
+    );
+
+    this.tag = `LXREQ${generateRandomNumber(2)}`;
+
+    const _this = this;
+
+    if (this.config.globalAccess) {
+      commonGlobal[this.tag] = new Proxy(this.data, {
+        get(target, props) {
+          if (typeof props === 'string') {
+            if (props === 'toJSON') {
+              return '{}';
+            }
+            return _this.getData(`${_this.tag}.${props}`);
+          }
+          return {};
+        },
+      });
+    }
+  }
+
+  public createId() {
+    return `${this.tag}.T${generateRandomNumber(2)}${Date.now()}`;
+  }
+
+  public store(id: string, key: string, value: any) {
+    const _id = id.replace(/(window|global|self|globalThis)\./g, '');
+    if (!this.storeAllKeys.includes(_id)) {
+      this.data[_id] = { [key]: value };
+      this.storeAllKeys.push(_id);
+      this.storeActiveKeys.push(_id);
+      if (
+        this.config.storeMax &&
+        this.storeActiveKeys.length > this.config.storeMax
+      ) {
+        const delkey = this.storeActiveKeys.shift();
+        if (delkey) {
+          delete this.data[delkey];
+        }
+      }
+    } else {
+      this.data[_id] = Object.assign(this.data[_id], { [key]: value });
+    }
+  }
+
+  public getData(id: string) {
+    if (this.storeAllKeys.includes(id) && !this.storeActiveKeys.includes(id)) {
+      message.warn('数据已失效');
+    }
+    return this.data[id];
+  }
+}
+
+export default DebugDataStore;

package/lib/public/src/utils/Security/debug/index.ts

@@ -0,0 +1,21 @@
+import storageUtil from '../utils/storge';
+import type { configTpe } from './data';
+import DebugDataStore from './data';
+
+// 通过本地存储的参数开启调试
+export const isAvailable = !!storageUtil.get('lxDebug');
+
+const debug = (() => {
+  if (isAvailable) {
+    let lxDebug = storageUtil.get('lxDebug');
+    try {
+      lxDebug = JSON.parse(lxDebug as string);
+    } catch {
+      lxDebug = 'true';
+    }
+    return new DebugDataStore(lxDebug === 'true' ? {} : (lxDebug as configTpe));
+  }
+  return null;
+})();
+
+export default debug;

package/lib/public/src/utils/Security/encipher/sign.ts

@@ -2,15 +2,12 @@
 import { SHA256 } from 'crypto-js';
 import { v4 as uuidv4 } from 'uuid';
 import config from '../config';
-import { aesKey, securityHeaderKey, signHeaderKey } from '../const';
+import { aesKey, reqIdKey } from '../const';
+import debug from '../debug';
 import { MODE, signHttpOptionsType } from '../types';
 import { checkIsSignMode } from '../utils/check';
 import message from '../utils/message';
-import {
-  decodeQueryString,
-  obj2QueryString,
-  removeURLParameters,
-} from '../utils/url';
+import { decodeQueryString, obj2QueryString } from '../utils/url';
 import { AESEncrypt } from './aes';
 
 // 注意：修改此文件请跑测试用例, npm run test
@@ -37,7 +34,7 @@ import { AESEncrypt } from './aes';
 
 // 由于X-B 的规则可能被业务网关使用，并往请求头增加内容，导致前后端加密不一致
 // 2022.08.09 使用以下3个固定值 + X-LX-*匹配 方式
-const hKeys = ['X-B-AUTH', 'X-B-TARGET-ID', 'APP-ID'];
+const hKeys = ['x-b-auth', 'x-b-target-id', 'app-id'];
 
 // 获取接口路径,2023-03-16调整，由于网关配置问题可能导致前后端取的服务地址不一致，调整后只取最后一级
 const getApiPath = (url: string) => {
@@ -72,13 +69,16 @@ export const createHttpSignStr = (
   let headerParams = '';
   const headersKeyArr: any = [];
   if (headers) {
-    Object.keys(headers)
-      .concat(config.sign?.includeHeaders || [])
-      .forEach((key) => {
-        if (key.startsWith('X-LX-') || hKeys.includes(key)) {
-          headersKeyArr.push(`${key.toLowerCase()}=${headers[key]}`);
-        }
-      });
+    const includesHeaderKeys =
+      config.sign?.headerKeys?.map((item) => item.toLowerCase()) || hKeys;
+    Object.keys(headers).forEach((key) => {
+      if (
+        key.startsWith('X-LX-') ||
+        includesHeaderKeys.includes(key.toLowerCase())
+      ) {
+        headersKeyArr.push(`${key.toLowerCase()}=${headers[key]}`);
+      }
+    });
   }
   headerParams = headersKeyArr.sort().join(';');
 
@@ -87,10 +87,11 @@ export const createHttpSignStr = (
   // body为空时，可能出现前后端取值不一致问题。
   // nodejs 一般存在空字符串、空对象、undefined、空表单 等，取决于框架处理和使用的中间件
   // java后端一般为null
+  // 目前与后端约定默认为空字符串
   let finallyBody = body;
-  if (typeof config.emptyBodyValue !== 'undefined') {
+  if (body === undefined || body === null) {
     finallyBody =
-      body === undefined || body === null ? config.emptyBodyValue : body;
+      typeof config.emptyBodyValue !== 'undefined' ? config.emptyBodyValue : '';
   }
   if (method.toLowerCase() === 'get') {
     // 为保证与后端值一致此处需要将数据进行解码
@@ -114,7 +115,6 @@ export const createHttpSignStr = (
   let result: string = '';
   switch (signVersion) {
     case MODE.SIGN:
-    case MODE.SIGN_KEY:
       content = [
         apiPath,
         headerParams,
@@ -165,48 +165,17 @@ export const createHttpSignStr = (
     message.log('url', url);
     message.log('str', content);
     message.log('sign', result);
+
+    if (headers?.[reqIdKey] && debug) {
+      debug.store(headers[reqIdKey], 'modeRequest', signVersion);
+      debug.store(headers[reqIdKey], 'url', url);
+      debug.store(headers[reqIdKey], 'str', content);
+      debug.store(headers[reqIdKey], 'sign', result);
+    }
   }
 
   // 返回约定签名
   return result;
 };
 
-// 由于（img、script）无法进行处理请求头，将签名参数x-sign放到url参数里
-export const buildXSignUrl = (
-  url: string,
-  options: signHttpOptionsType = {},
-  version?: any,
-) => {
-  if (!url) {
-    return '';
-  }
-  if (version && !checkIsSignMode(version)) {
-    message.warn(`不支持[${version}]签名模式`);
-    return url;
-  }
-  let _url = url;
-  const signVersion =
-    version || checkIsSignMode(config.mode as MODE)
-      ? config.mode
-      : MODE.SIGN_WITH_TIME;
-  const signStr = createHttpSignStr(
-    url,
-    { method: 'GET', ...options },
-    signVersion,
-  );
-  // 如果url上存在签名则移除原签名
-  if (
-    url.indexOf(signHeaderKey) !== -1 ||
-    url.indexOf(securityHeaderKey) !== -1
-  ) {
-    _url = removeURLParameters(url, [signHeaderKey, securityHeaderKey]);
-  }
-  return `${_url}${
-    _url.includes('?') ? '&' : '?'
-  }${signHeaderKey}=${signStr}&${securityHeaderKey}=${signVersion}`;
-};
-
-// buildXSignUrl兼容平台内部使用，外部使用createHttpSignWithUrl
-export const createHttpSignWithUrl = buildXSignUrl;
-
-export default { createHttpSignStr, createHttpSignWithUrl };
+export default { createHttpSignStr };

package/lib/public/src/utils/Security/html.ts

@@ -0,0 +1,52 @@
+import type { securityType } from './types';
+
+/**
+ * 移除内容里恶意html代码(xss攻击)
+ * @param str 待处理html内容
+ * @param options 可选配置项
+ * @return 安全的html片段
+ */
+const safeHTML: typeof securityType.html.safeHTML = (str, options) => {
+  if (typeof str !== 'string') return str || '';
+  const blacklist = options?.blackList || ['script', 'style', 'iframe'];
+
+  // 创建一个新的 DOM 解析器对象
+  const parser = new DOMParser();
+
+  // 使用 parseFromString 方法将 HTML 片段转换为 DOM 对象
+  const doc = parser.parseFromString(str, 'text/html');
+
+  // 遍历 DOM 树并删除恶意节点
+  function cleanNode(node: Element) {
+    if (node.nodeType === 1) {
+      // 元素节点
+      if (blacklist.indexOf(node.nodeName.toLowerCase()) !== -1) {
+        node.parentNode?.removeChild(node);
+        return;
+      }
+
+      // 移除元素节点上所有事件属性
+      for (let i = node.attributes.length - 1; i >= 0; i -= 1) {
+        const attr = node.attributes[i];
+        if (
+          attr.name.startsWith('on') ||
+          String(node.getAttribute(attr.name))
+            .toLowerCase()
+            .indexOf('javascript:') !== -1
+        ) {
+          node.removeAttribute(attr.name);
+        }
+      }
+    }
+
+    for (let i = 0; i < node.childNodes.length; i += 1) {
+      cleanNode(node.childNodes[i] as Element);
+    }
+  }
+  cleanNode(doc.body);
+  return doc.body.innerHTML;
+};
+
+export default {
+  safeHTML,
+};

package/lib/public/src/utils/Security/httpEncryption.ts

@@ -4,14 +4,8 @@
  * @Description: 一个简单的http请求安全加密处理
  */
 
-// TODO 支持XMLHttpRequest拦截、参数混淆、响应拦截
-
-// 使用方式1: 使用fetch请求模块，start({ mode: signKey })，适应经过封装的fetch模块
-// 使用方式2: 使用fetch请求模块，将window.fetch 替换成 fetch，适应自己封装的fetch模块
-// 使用方式3: 不使用fetch请求模块，使用createHttpSignStr自己获取签名，自行在header上添加参数
-import merge from 'merge';
-import capabilities from './clientCapabilities';
-import config, { createDefaultConfig, setConfig } from './config';
+import capabilities, { isBrowser } from './clientCapabilities';
+import config, { setConfig } from './config';
 import {
   conflict as conflictFetch,
   noConflict as noConflictFetch,
@@ -28,22 +22,48 @@ import type { configType } from './types';
 import { checkIsModeValue } from './utils/check';
 import message from './utils/message';
 
-let isHttpEncryption = false;
+// 在浏览器模式下可能由于多个子工程集成造成多次conflict引发异常，在浏览器里需要将开关配置全局化
+const _switch: Record<string, any> = {
+  _isHttpEncryption: false,
+};
+
+Object.defineProperty(
+  _switch,
+  'isHttpEncryption',
+  isBrowser
+    ? {
+        get() {
+          return (window as any).isLxHttpEncryption ?? this._isHttpEncryption;
+        },
+        set(value) {
+          (window as any).isLxHttpEncryption = value;
+          this._isHttpEncryption = value;
+        },
+      }
+    : {
+        get() {
+          return this._isHttpEncryption;
+        },
+        set(value) {
+          this._isHttpEncryption = value;
+        },
+      },
+);
+
 const noConflictList: Function[] = [];
 
 function start(startConfig?: configType) {
-  if (isHttpEncryption) {
-    message.warn('安全模式已开启,请使用stop方法停止后再重新开启');
-    return true;
+  if (_switch.isHttpEncryption) {
+    return null;
   }
 
-  const _startConfig = merge.recursive({}, createDefaultConfig(), startConfig);
-
-  const mode = _startConfig.mode as string;
-  if (checkIsModeValue(mode)) {
-    isHttpEncryption = true;
+  // const _startConfig = merge.recursive({}, createDefaultConfig(), startConfig);
+  const mode = startConfig?.mode;
+  // 如果存在设置mode，校验mode，如果为空时，使用config预置的
+  if (!mode || checkIsModeValue(mode)) {
+    _switch.isHttpEncryption = true;
     // 设置
-    setConfig(_startConfig);
+    setConfig(startConfig || {});
 
     // 按需启动请求劫持
     if (capabilities.fetch && config.requester?.includes('fetch')) {
@@ -58,15 +78,14 @@ function start(startConfig?: configType) {
       conflictWxRequest();
       noConflictList.push(noConflictWxRequest);
     }
-  } else {
-    message.error(`http安全开启失败,不支持${mode}模式`);
+    return true;
   }
-
-  return isHttpEncryption;
+  message.error(`http安全开启失败,不支持${mode}模式`);
+  return false;
 }
 
 function stop() {
-  isHttpEncryption = false;
+  _switch.isHttpEncryption = false;
   noConflictList.forEach((noConflict) => {
     noConflict();
   });

package/lib/public/src/utils/Security/index.ts

@@ -1,28 +1,36 @@
-import { setConfig } from './config';
-import KEYS from './const';
+import { getConfig, initConfig, setConfig } from './config';
 import { AESDecrypt, AESEncrypt } from './encipher/aes';
-import { DESDecrypt, DESEncrypt } from './encipher/des';
 import { RSADecrypt, RSAEncrypt } from './encipher/rsa';
-import { createHttpSignStr, createHttpSignWithUrl } from './encipher/sign';
+import { createHttpSignStr } from './encipher/sign';
 import { checkToken, generateToken } from './encipher/token';
+import html from './html';
 import httpEncryption from './httpEncryption';
+import {
+  autoSecurityWithUrl,
+  createEncryptedWithUrl,
+  createHttpSignWithUrl,
+} from './urlEncryption';
 import { lxEncrypt } from './utils/encrypted';
 
+export { aesKey, rsaPrivKey, rsaPublicKey, signKey } from './const';
+
 const security = {
   httpEncryption,
   createHttpSignStr,
   createHttpSignWithUrl,
+  createEncryptedWithUrl,
+  autoSecurityWithUrl,
   RSAEncrypt,
   RSADecrypt,
   AESEncrypt,
   AESDecrypt,
-  DESEncrypt,
-  DESDecrypt,
-  KEYS,
   checkToken,
   generateToken,
   setConfig,
+  getConfig,
+  initConfig,
   lxEncrypt,
+  html,
 };
 
 export default security;

package/lib/public/src/utils/Security/requester/fetch.ts

@@ -1,5 +1,7 @@
 import capabilities from '../clientCapabilities';
 import config from '../config';
+import { commonGlobal, reqIdKey } from '../const';
+import debug from '../debug';
 import { createHttpSignStr } from '../encipher/sign';
 import {
   checkIsEncryption,
@@ -10,78 +12,102 @@ import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
 import message from '../utils/message';
 
 const originRequester: any = capabilities.fetch
-  ? (window || globalThis).fetch
+  ? commonGlobal.fetch
   : undefined;
 
 const fetch = (url: any, fetchOptions: any = {}): Promise<any> => {
   let requester: Promise<any>;
   const opts = { ...fetchOptions };
 
-  // 判定是否符合忽略规则
-  if (checkIsUrlIgnore(url, opts)) {
-    return originRequester(url, opts);
+  const securityHeaderKey = config.securityHeaderKey as string;
+
+  const debugId = debug?.createId();
+
+  if (debugId) {
+    opts.headers[reqIdKey] = debugId;
   }
 
-  // 请求头配置
-  // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
-  // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
-  // headers[securityHeaderKey] 指定当前服务安全模式
-  const securityHeaderKey = config.securityHeaderKey as string;
-  const modeInHeadParam = (opts.headers || {})[securityHeaderKey];
-
-  // 优先使用当前请求头指定的安全模式
-  const finallyMode = modeInHeadParam || config.mode;
-
-  // 通过请求头参数关闭当次安全模式
-  if (
-    String(modeInHeadParam) === 'false' ||
-    opts.headers?.disabledSignKey === true ||
-    opts.headers?.disabledEncrypted === true ||
-    finallyMode === false
-  ) {
-    // 不能直接删除，否则会导致disabledSignKey 这个节点删除了，第二次进来的时候导致异常
-    // const { disabledSignKey, ...resprops } = opts?.headers;
-    const _cloneHeader = Object.assign({}, opts.headers);
-    delete _cloneHeader.disabledSignKey;
-    delete _cloneHeader.disabledEncrypted;
-    delete _cloneHeader[securityHeaderKey];
-    requester = originRequester(url, { ...opts, headers: { ..._cloneHeader } });
-  } else if (checkIsSignMode(finallyMode)) {
-    // ------ 参数签名(默认) ------
-    const signValueKeyName = config.sign?.valueKeyName as string;
-    opts.headers = {
-      [securityHeaderKey]: finallyMode,
-      ...opts.headers,
-      [signValueKeyName]: createHttpSignStr(url, fetchOptions, finallyMode),
-    };
+  // 判定是否符合忽略规则
+  if (checkIsUrlIgnore(url, opts)) {
     requester = originRequester(url, opts);
-  } else if (checkIsEncryption(finallyMode)) {
-    // ------ 参数加密 ------
-    // search和body加密
-    const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
-      url,
-      opts,
-      finallyMode,
-    );
-
-    requester = originRequester(encryptedUrl, encryptedOpts);
   } else {
-    // 其他
-    requester = originRequester(url, opts);
+    // 请求头配置
+    // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
+    // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
+    // headers[securityHeaderKey] 指定当前服务安全模式
+    const modeInHeadParam = (opts.headers || {})[securityHeaderKey];
+
+    // 优先使用当前请求头指定的安全模式
+    const finallyMode = modeInHeadParam || config.mode;
+
+    // 通过请求头参数关闭当次安全模式
+    if (
+      String(modeInHeadParam) === 'false' ||
+      opts.headers?.disabledSignKey === true ||
+      opts.headers?.disabledEncrypted === true ||
+      finallyMode === false
+    ) {
+      // 不能直接删除，否则会导致disabledSignKey 这个节点删除了，第二次进来的时候导致异常
+      // const { disabledSignKey, ...resprops } = opts?.headers;
+      const _cloneHeader = Object.assign({}, opts.headers);
+      delete _cloneHeader.disabledSignKey;
+      delete _cloneHeader.disabledEncrypted;
+      delete _cloneHeader[securityHeaderKey];
+      requester = originRequester(url, {
+        ...opts,
+        headers: { ..._cloneHeader },
+      });
+    } else if (checkIsSignMode(finallyMode)) {
+      // ------ 参数签名(默认) ------
+      const signValueKeyName = config.sign?.valueKeyName as string;
+      opts.headers = {
+        [securityHeaderKey]: finallyMode,
+        ...opts.headers,
+        [signValueKeyName]: createHttpSignStr(url, fetchOptions, finallyMode),
+      };
+      requester = originRequester(url, opts);
+    } else if (checkIsEncryption(finallyMode)) {
+      // ------ 参数加密 ------
+      // search和body加密
+      const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
+        url,
+        opts,
+        finallyMode,
+        'fetch',
+      );
+
+      requester = originRequester(encryptedUrl, encryptedOpts);
+    } else {
+      // 其他
+      requester = originRequester(url, opts);
+    }
+
+    // 记录请求debug信息
+    if (debugId) {
+      debug?.store(debugId, 'modeRequest', finallyMode);
+      debug?.store(debugId, 'url', url);
+      try {
+        debug?.store(debugId, 'param', JSON.parse(opts.body));
+      } catch {
+        debug?.store(debugId, 'param', opts.body);
+      }
+    }
   }
 
   // ------ 响应解密 ------
   return requester.then(async (response: Response) => {
+    // headers.get对大小写不敏感
     const securityType = response.headers.get(securityHeaderKey);
 
     if (securityType && checkIsEncryption(securityType) && response.body) {
+      const contentType = response.headers.get('Content-Type');
       // 响应数据
       const respResult = await response.text();
 
       // 解密数据
       let result;
       try {
-        result = decryptedStr(respResult, securityType, config);
+        result = decryptedStr(respResult, securityType);
       } catch (e) {
         message.error('--------解密失败--------');
         // message.error(`请求ID：${reqId}`);
@@ -100,8 +126,14 @@ const fetch = (url: any, fetchOptions: any = {}): Promise<any> => {
         json = result;
         message.warn(`响应报文转换JSON失败, 内容为 ${result}`);
       }
+
+      // 记录响应debug信息
+      if (debugId) {
+        debug?.store(debugId, 'modeResopnse', securityType);
+        debug?.store(debugId, 'response', json);
+      }
       const blob = new Blob([JSON.stringify(json, null, 2)], {
-        type: 'application/json',
+        type: contentType || 'application/json',
       });
       return new Response(blob);
     }
@@ -109,11 +141,14 @@ const fetch = (url: any, fetchOptions: any = {}): Promise<any> => {
   });
 };
 
+// 标记劫持的fetch
+fetch.isLxSecurity = true;
+
 export const conflict = () => {
-  (window || globalThis).fetch = fetch;
+  commonGlobal.fetch = fetch;
 };
 export const noConflict = () => {
-  (window || globalThis).fetch = originRequester;
+  commonGlobal.fetch = originRequester;
 };
 
 export default fetch;