@lingxiteam/ebe-utils 0.0.33 → 0.0.35

package/lib/public/src/utils/Security/requester/wx.ts

@@ -1,6 +1,9 @@
 import capabilities from '../clientCapabilities';
 import config from '../config';
+import { reqIdKey } from '../const';
+import debug from '../debug';
 import { createHttpSignStr } from '../encipher/sign';
+import { getObjectValue } from '../utils/caseInsensitive';
 import {
   checkIsEncryption,
   checkIsSignMode,
@@ -8,6 +11,7 @@ import {
   checkIsUrlIgnore,
 } from '../utils/check';
 import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
+import { addUrlParameters } from '../utils/url';
 
 const originRequester: any = capabilities.wxRequest ? wx.request : undefined;
 
@@ -27,6 +31,18 @@ const wxRequest = (
   }
 
   let requester;
+
+  // 记录原始请求数据，数据调试时查看
+  const originRequestData = opts.data;
+
+  // wx直接在控制台输入变量访问的是window下的变量，但js执行写入的变量在global，需特殊处理debugId
+  const debugId = `global.${debug?.createId()}`;
+  if (debugId) {
+    opts.header
+      ? (opts.header[reqIdKey] = debugId)
+      : (opts.header = { [reqIdKey]: debugId });
+  }
+
   // 请求头配置
   // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
   // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
@@ -37,17 +53,22 @@ const wxRequest = (
   // 优先使用当前请求头指定的安全模式
   const finallyMode = modeInHeadParam || config.mode;
 
-  // 拦截success，处理解密
+  // 拦截success、fail，处理解密
   const originSuccess = opts.success;
   if (originSuccess) {
     const success: WechatMiniprogram.RequestSuccessCallback = (response) => {
-      const securityType = response.header[securityHeaderKey];
+      // wxrequest没有提供像 Headers.get 和 xhr.getResponseHeader 获取请求头信息(对大小写不敏感), 故此处需通过工具函数获取
+      const securityType = getObjectValue(response.header, securityHeaderKey);
       if (checkIsEncryption(securityType)) {
         let result;
         try {
           if (typeof response.data === 'string') {
-            result = decryptedStr(response.data, securityType, config);
-            if (response.header['content-type'] === 'application/json') {
+            result = decryptedStr(response.data, securityType);
+            if (
+              getObjectValue(response.header, 'Content-Type').indexOf(
+                'application/json',
+              ) !== -1
+            ) {
               result = JSON.parse(result);
             }
           }
@@ -55,6 +76,11 @@ const wxRequest = (
           response.data =
             typeof result === 'undefined' ? response.data : result;
         }
+        // 记录响应debug信息
+        if (debugId) {
+          debug?.store(debugId, 'modeResponse', securityType);
+          debug?.store(debugId, 'response', result);
+        }
       }
       originSuccess(response);
     };
@@ -81,11 +107,23 @@ const wxRequest = (
     opts.header = {
       ...(opts.header || {}),
       [securityHeaderKey]: finallyMode,
-      [signValueKeyName]: createHttpSignStr(
-        opts.url,
-        { method: opts.method, body: opts.data },
-        finallyMode,
-      ),
+      // 当get请求时，会将data拼装在url上，签名时需对url处理
+      [signValueKeyName]:
+        opts.method?.toLowerCase() === 'get' &&
+        Object.prototype.toString.call(opts.data) === '[object Object]'
+          ? createHttpSignStr(
+              addUrlParameters(
+                opts.url,
+                opts.data as WechatMiniprogram.IAnyObject,
+              ),
+              { method: opts.method, body: undefined, headers: opts.header },
+              finallyMode,
+            )
+          : createHttpSignStr(
+              opts.url,
+              { method: opts.method, body: opts.data, headers: opts.header },
+              finallyMode,
+            ),
     };
     // 后端根据cookie里的值进行校验
     if (checkIsSignWithSalt(finallyMode)) {
@@ -103,8 +141,12 @@ const wxRequest = (
     // search和body加密
     const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
       opts.url,
-      { body: opts.data, headers: opts.header },
+      {
+        body: opts.data,
+        headers: { method: opts.method, ...(opts.header || {}) },
+      },
       finallyMode,
+      'wxRequest',
     );
     opts.url = encryptedUrl;
     if (encryptedOpts.body) {
@@ -113,12 +155,19 @@ const wxRequest = (
     if (encryptedOpts.headers) {
       opts.header = encryptedOpts.headers;
     }
-    requester = originRequester(encryptedUrl, encryptedOpts);
+    requester = originRequester(opts);
   } else {
     // 其他
     requester = originRequester(opts);
   }
 
+  // 记录请求debug信息
+  if (debugId) {
+    debug?.store(debugId, 'modeRequest', finallyMode);
+    debug?.store(debugId, 'url', opts.url);
+    debug?.store(debugId, 'param', originRequestData);
+  }
+
   return requester;
 };
 

package/lib/public/src/utils/Security/requester/xhr.ts

@@ -1,11 +1,16 @@
+import capabilities from '../clientCapabilities';
 import config from '../config';
-// import { checkIsSignMode, checkIsEncryption, checkIsUrlIgnore, checkIsSignWithSalt } from '../utils/check';
+import { commonGlobal, reqIdKey } from '../const';
+import debug from '../debug';
 import { createHttpSignStr } from '../encipher/sign';
-import { checkIsUrlIgnore } from '../utils/check';
-// import { encryptedRequestParams, decryptedStr } from '../utils/encrypted';
-import capabilities from '../clientCapabilities';
+import {
+  checkIsEncryption,
+  checkIsSignMode,
+  checkIsUrlIgnore,
+} from '../utils/check';
+import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
 
-const originRequester: any = capabilities.xhr ? XMLHttpRequest : undefined;
+const OriginRequester: any = capabilities.xhr ? XMLHttpRequest : undefined;
 
 // 从请求头中获取参数
 function getRequestHeaders(xhr: XMLHttpRequest) {
@@ -14,15 +19,16 @@ function getRequestHeaders(xhr: XMLHttpRequest) {
     .getAllResponseHeaders()
     .split('\n')
     .forEach((header) => {
-      const [key, value] = header.split(': ');
-      headers[key] = value;
+      if (header) {
+        const [key, value] = header.split(': ');
+        headers[key] = value;
+      }
     });
   return headers;
 }
 
 const xhr = function () {
-  // eslint-disable-next-line new-cap
-  const originXhr = new originRequester();
+  const instanceXhr = new OriginRequester();
 
   const securityHeaderKey = config.securityHeaderKey as string;
   const signValueKeyName = config.sign?.valueKeyName as string;
@@ -30,13 +36,16 @@ const xhr = function () {
   let finallyMode: any = config.mode;
   let xhrUrl: string = '';
   let xhrMethod: any = '';
+  const openOptions: any = {};
 
   // 用于存储请求头信息
   const requestHeaders: any = {};
 
-  // 劫持 open 方法
-  const originalOpen = originXhr.open;
-  originXhr.open = function (
+  const debugId = debug?.createId();
+
+  // 劫持: open 方法, 记录url、请求头等信息
+  const originalOpen = instanceXhr.open;
+  instanceXhr.open = function (
     method: string,
     url: string,
     async?: boolean,
@@ -46,16 +55,26 @@ const xhr = function () {
     // 记录url地址
     xhrUrl = url;
     xhrMethod = method;
+    openOptions.async = async;
+    openOptions.user = user;
+    openOptions.password = password;
     // 获取请求头中的参数
-    const _requestHeaders = getRequestHeaders(originXhr);
+    const _requestHeaders = getRequestHeaders(instanceXhr);
     Object.assign(requestHeaders, _requestHeaders);
-    // 调用原始的 open 方法
-    originalOpen.call(this, method, url, async, user, password);
+    // 调用原始的 open 方法（async不能为undefined，不然引起调用报错）
+    originalOpen.call(
+      this,
+      method,
+      url,
+      typeof async === 'undefined' ? true : async,
+      user,
+      password,
+    );
   };
 
-  // 劫持 setRequestHeader 方法
-  const originalSetRequestHeader = originXhr.setRequestHeader;
-  originXhr.setRequestHeader = function (
+  // 劫持: setRequestHeader 方法，记录请求头信息
+  const originalSetRequestHeader = instanceXhr.setRequestHeader;
+  instanceXhr.setRequestHeader = function (
     key: string,
     value: string | number | boolean,
   ) {
@@ -66,9 +85,10 @@ const xhr = function () {
     originalSetRequestHeader.call(this, key, value);
   };
 
-  // 劫持 send 方法
-  const originalSend = originXhr.send;
-  originXhr.send = function (data: any) {
+  // 劫持: send 方法，进行签名或加密处理
+  const originalSend = instanceXhr.send;
+
+  instanceXhr.send = function (data: any) {
     // 判定是否符合忽略规则
     if (
       checkIsUrlIgnore(xhrUrl, {
@@ -81,41 +101,175 @@ const xhr = function () {
       return;
     }
 
-    // 获取请求头信息
-    const requestHeadersSnapshot = { ...requestHeaders };
+    // 加密后的请求数据(加密模式下保存的加密数据)
+    let encryptedData: any;
 
     // 优先使用请求头自带的模式
-    if (requestHeadersSnapshot[securityHeaderKey]) {
-      finallyMode = requestHeadersSnapshot[securityHeaderKey];
+    if (requestHeaders[securityHeaderKey]) {
+      finallyMode = requestHeaders[securityHeaderKey];
     }
 
-    // 签名并添加额外的参数
-    originalSetRequestHeader.call(this, securityHeaderKey, finallyMode);
-    originalSetRequestHeader.call(
-      this,
-      signValueKeyName,
-      createHttpSignStr(
+    // 请求头上添加安全模式标识
+    this.setRequestHeader(securityHeaderKey, finallyMode);
+
+    // 请求头上添加debug标识
+    if (debugId) {
+      this.setRequestHeader(reqIdKey, debugId);
+    }
+
+    if (checkIsSignMode(finallyMode)) {
+      // 签名并添加额外的参数
+      originalSetRequestHeader.call(
+        this,
+        signValueKeyName,
+        createHttpSignStr(
+          xhrUrl,
+          { method: xhrMethod, headers: requestHeaders, body: data },
+          finallyMode,
+        ),
+      );
+    } else if (checkIsEncryption(finallyMode)) {
+      // 加密处理
+      const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
         xhrUrl,
-        { method: xhrMethod, headers: requestHeadersSnapshot, body: data },
+        { headers: requestHeaders, body: data },
         finallyMode,
-      ),
-    );
+        'xhr',
+      );
+      // 如果url参数加密了，则重新open一个新地址
+      if (encryptedUrl !== xhrUrl) {
+        originalOpen.call(
+          this,
+          xhrMethod,
+          encryptedUrl,
+          typeof openOptions.async === 'undefined' ? true : openOptions.async,
+          openOptions.user,
+          openOptions.password,
+        );
+        // 重新设置header上的字段
+        Object.keys(requestHeaders).forEach((key) => {
+          originalSetRequestHeader.call(this, key, requestHeaders[key]);
+        });
+      }
+      encryptedData = encryptedOpts.body;
+    }
 
-    // 修改请求 URL
-    //  originXhr.open(originXhr.method, url, originXhr.async, originXhr.username, originXhr.password);
+    // 记录请求debug信息
+    if (debugId) {
+      debug?.store(debugId, 'modeRequest', finallyMode);
+      debug?.store(debugId, 'url', xhrUrl);
+      debug?.store(debugId, 'param', data);
+    }
 
     // 调用原始的 send 方法
-    originalSend.call(this, data);
+    originalSend.call(this, encryptedData || data);
+  };
+
+  // 劫持: 获取response内容，响应解密处理
+  const stashResponse: Record<string, any> = {};
+  let onreadystatechange: Function;
+  const getEncryptionResponseContent = (
+    _xhr: XMLHttpRequest,
+    key: 'response' | 'responseText' | 'responseXML',
+    securityType: any,
+  ) => {
+    if (typeof stashResponse[key] === 'string') {
+      return decryptedStr(stashResponse[key], securityType);
+    }
+    return stashResponse[key];
   };
+  instanceXhr.onreadystatechange = function () {
+    if (instanceXhr.readyState === 4) {
+      // getResponseHeader方法标头名称的搜索不区分大小写
+      const securityType = instanceXhr.getResponseHeader(securityHeaderKey);
+      // 如果是需要解密，则劫持response
+      if (securityType && checkIsEncryption(securityType)) {
+        // 记录原Response内容
+        stashResponse.response = instanceXhr.response;
+        stashResponse.responseText = instanceXhr.responseText;
+        stashResponse.responseXML = instanceXhr.responseXML;
 
-  return originXhr;
+        // 记录响应debug信息
+        if (debugId && debug) {
+          const content = getEncryptionResponseContent(
+            instanceXhr,
+            'response',
+            securityType,
+          );
+          let finallyResponse: any;
+          try {
+            finallyResponse = JSON.parse(content);
+          } catch (e) {
+            finallyResponse = content;
+          }
+          debug.store(debugId, 'modeResponse', securityType);
+          debug.store(debugId, 'response', finallyResponse);
+        }
+        // 劫持Response getter进行解密
+        Object.defineProperties(instanceXhr, {
+          response: {
+            get() {
+              return getEncryptionResponseContent(
+                this,
+                'response',
+                securityType,
+              );
+            },
+            configurable: true,
+            enumerable: false,
+          },
+          responseText: {
+            get() {
+              return getEncryptionResponseContent(
+                this,
+                'responseText',
+                securityType,
+              );
+            },
+            configurable: true,
+            enumerable: false,
+          },
+          responseXML: {
+            get() {
+              return getEncryptionResponseContent(
+                this,
+                'responseXML',
+                securityType,
+              );
+            },
+            configurable: true,
+            enumerable: false,
+          },
+        });
+      }
+    }
+    if (typeof onreadystatechange === 'function') {
+      onreadystatechange.call(this);
+    }
+  };
+
+  Object.defineProperties(instanceXhr, {
+    onreadystatechange: {
+      set(value) {
+        onreadystatechange = value;
+      },
+      configurable: true,
+      enumerable: false,
+    },
+  });
+
+  // 处理完毕，返回xhr实例
+  return instanceXhr;
 };
 
+// 标记劫持的XMLHttpRequest
+xhr.isLxSecurity = true;
+
 export const conflict = () => {
-  (window as any).XMLHttpRequest = xhr;
+  commonGlobal.XMLHttpRequest = xhr;
 };
 export const noConflict = () => {
-  (window as any).XMLHttpRequest = originRequester;
+  commonGlobal.XMLHttpRequest = OriginRequester;
 };
 
 export default xhr;

package/lib/public/src/utils/Security/types.ts

@@ -1,8 +1,6 @@
-type requester = 'fetch' | 'xhr' | 'wxRequest';
+export type requester = 'fetch' | 'xhr' | 'wxRequest';
 
 export const enum MODE {
-  // 参数签名(旧数据)
-  SIGN_KEY = 'signKey',
   // 参数签名
   SIGN = '1.0',
   // 时间限制性签名
@@ -17,21 +15,17 @@ export const enum MODE {
   RSA = '2.0',
   // AES参数加密
   AES = '3.0',
-  // DES参数加密
-  DES = '4.0',
 }
 
+export type modeType = `${(typeof MODE)[keyof typeof MODE]}`;
+
 // 自定义加解密函数
 type EncryptionFunctionType = (
   content: string,
   key: string,
-  CryptoJS: CryptoJS,
+  CryptoJS: any,
 ) => string;
 
-export type fnDESEncryptType = EncryptionFunctionType;
-
-export type fnDESDecryptType = EncryptionFunctionType;
-
 export type fnAESEncryptType = EncryptionFunctionType;
 
 export type fnAESDecryptType = EncryptionFunctionType;
@@ -39,13 +33,13 @@ export type fnAESDecryptType = EncryptionFunctionType;
 export type fnRSAEncryptType = (
   content: string,
   publicKey: string,
-  JSEncrypt: JSEncrypt,
+  JSEncrypt: any,
 ) => string;
 
 export type fnRSADecryptType = (
   content: string,
   privKey: string,
-  JSEncrypt: JSEncrypt,
+  JSEncrypt: any,
 ) => string;
 
 export declare namespace encipherOptionType {
@@ -54,7 +48,7 @@ export declare namespace encipherOptionType {
     saltKey?: string;
     saltValue?: string | Function;
     valueKeyName?: string;
-    includeHeaders?: string[];
+    headerKeys?: string[];
   }
   interface aes {
     key?: string;
@@ -62,12 +56,6 @@ export declare namespace encipherOptionType {
     decrypt?: fnAESDecryptType;
   }
 
-  interface des {
-    key?: string;
-    encrypt?: fnDESEncryptType;
-    decrypt?: fnDESDecryptType;
-  }
-
   interface rsa {
     privKey?: string;
     publicKey?: string;
@@ -78,13 +66,12 @@ export declare namespace encipherOptionType {
 
 type ignoreSupportType = string | RegExp | Function;
 export interface configType {
-  mode?: MODE;
+  mode?: modeType;
   securityHeaderKey?: string;
   requester?: requester | requester[];
   ignore?: ignoreSupportType | ignoreSupportType[];
   sign?: encipherOptionType.sign;
   aes?: encipherOptionType.aes;
-  des?: encipherOptionType.des;
   rsa?: encipherOptionType.rsa;
   timeDeviation?: number;
   debug?: boolean;
@@ -108,72 +95,3 @@ export interface signHttpOptionsType {
   search?: string | any;
   saltValue?: string;
 }
-
-namespace securityType {
-  export interface httpEncryption {
-    start: (startConfig?: configType) => void;
-    stop: () => void;
-  }
-
-  export function createHttpSignStr(
-    url: string,
-    options: signHttpOptionsType,
-    version?: any,
-  ): string;
-
-  export function createHttpSignWithUrl(
-    url: string,
-    options?: signHttpOptionsType,
-    version?: any,
-  ): string;
-
-  export function RSAEncrypt(
-    content: string,
-    publicKey: string,
-    handle?: fnRSAEncryptType,
-  ): string;
-
-  export function RSADecrypt(
-    content: string,
-    privKey: string,
-    handle?: fnRSADecryptType,
-  ): string;
-
-  export function AESEncrypt(
-    content: string,
-    aesKey: string,
-    handle?: fnAESEncryptType,
-  ): string;
-
-  export function AESDecrypt(
-    content: string,
-    aesKey: string,
-    handle?: fnAESDecryptType,
-  ): string;
-
-  export function DESEncrypt(
-    content: string,
-    desKey: string,
-    handle?: fnDESEncryptType,
-  ): string;
-
-  export function DESDecrypt(
-    content: string,
-    desKey: string,
-    handle?: fnDESDecryptType,
-  ): string;
-
-  export function setConfig(config: configType): void;
-
-  export function lxEncrypt(str: string): string;
-
-  export type httpEncryptionConfigType = typeof configType;
-
-  export type KEYS = {
-    signKey: string;
-    rsaPublicKey: string;
-    rsaPrivKey: string;
-    aesKey: string;
-    desKey: string;
-  };
-}