@lingxiteam/ebe-utils 0.0.33 → 0.0.35

package/lib/public/src/utils/Security/urlEncryption.ts

@@ -0,0 +1,108 @@
+import config from './config';
+import { securityHeaderKey, signHeaderKey } from './const';
+import { createHttpSignStr } from './encipher/sign';
+import { MODE, modeType, securityType } from './types';
+import { checkIsEncryption, checkIsSignMode } from './utils/check';
+import {
+  decryptedStrForSearchParams,
+  encryptedStrForSearchParams,
+} from './utils/encrypted';
+import message from './utils/message';
+import { getSearchObj, removeURLParameters } from './utils/url';
+
+export const createHttpSignWithUrl: typeof securityType.createHttpSignWithUrl =
+  (url, options = {}, version) => {
+    if (!url) {
+      return '';
+    }
+    if (version && !checkIsSignMode(version)) {
+      message.warn(`不支持[${version}]签名模式`);
+      return url;
+    }
+    let _url = url;
+    const signVersion =
+      version ||
+      (checkIsSignMode(config.mode as MODE)
+        ? config.mode
+        : MODE.SIGN_WITH_TIME);
+    const signStr = createHttpSignStr(
+      url,
+      { method: 'GET', ...options },
+      signVersion,
+    );
+    // 如果url上存在签名则移除原签名
+    if (
+      url.indexOf(signHeaderKey) !== -1 ||
+      url.indexOf(securityHeaderKey) !== -1
+    ) {
+      _url = removeURLParameters(url, [signHeaderKey, securityHeaderKey]);
+    }
+    return `${_url}${
+      _url.includes('?') ? '&' : '?'
+    }${signHeaderKey}=${signStr}&${securityHeaderKey}=${signVersion}`;
+  };
+
+/**
+ * 将url里的参数进行加密
+ * @param url url地址
+ * @param version 加密模式
+ * @returns 加密处理后的url地址(带加密模式标记)
+ */
+export const createEncryptedWithUrl: typeof securityType.createEncryptedWithUrl =
+  (url, version) => {
+    if (!url) {
+      return '';
+    }
+    if (version && !checkIsEncryption(version)) {
+      return url;
+    }
+    if (url.indexOf('?') !== -1) {
+      const encryptedMode = version || '3.0';
+      return `${url.replace(/[^?]+$/g, (data) =>
+        encryptedStrForSearchParams(data, encryptedMode),
+      )}&${securityHeaderKey}=${encryptedMode}`;
+    }
+    return url;
+  };
+
+export const autoSecurityWithUrl: typeof securityType.autoSecurityWithUrl = (
+  url,
+  options,
+) => {
+  let originUrl: string = url;
+  const securityHeaderKey = config.securityHeaderKey as string;
+  const confiMode = config.mode as modeType;
+  const modeInUrl = getSearchObj(url)[securityHeaderKey];
+  const finallyMode =
+    typeof options?.modeRule === 'function'
+      ? options.modeRule(confiMode)
+      : confiMode;
+  // 处理旧模式url
+  if (modeInUrl) {
+    if (checkIsEncryption(modeInUrl)) {
+      if (finallyMode === modeInUrl) {
+        // 如果地址处理前后均为相同加密方式则不需处理
+        return url;
+      }
+      // 否则对url进行解密并移除旧模式参数标识
+      originUrl = removeURLParameters(url, [securityHeaderKey]).replace(
+        /[^?]+$/g,
+        (data) => decryptedStrForSearchParams(data, modeInUrl),
+      );
+    } else if (checkIsSignMode(modeInUrl)) {
+      // 移除旧模式参数标识
+      originUrl = removeURLParameters(url, [
+        config.sign?.valueKeyName as string,
+        securityHeaderKey,
+      ]);
+    }
+  }
+  // 执行加签或加密处理
+  if (checkIsSignMode(finallyMode)) {
+    return createHttpSignWithUrl(originUrl, {}, finallyMode);
+  }
+  if (checkIsEncryption(finallyMode)) {
+    return createEncryptedWithUrl(originUrl, finallyMode as '2.0' | '3.0');
+  }
+  return originUrl;
+};

package/lib/public/src/utils/Security/utils/atob.ts

@@ -0,0 +1,34 @@
+/* eslint-disable no-bitwise */
+/* eslint-disable no-plusplus */
+
+const customAtob = (str: string) => {
+  if (typeof atob === 'function') {
+    return atob(str);
+  }
+  const base64 =
+    'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
+  let result = '';
+
+  for (let i = 0; i < str.length; ) {
+    const char1 = base64.indexOf(str.charAt(i++));
+    const char2 = base64.indexOf(str.charAt(i++));
+    const char3 = base64.indexOf(str.charAt(i++));
+    const char4 = base64.indexOf(str.charAt(i++));
+
+    const byte1 = (char1 << 2) | (char2 >> 4);
+    const byte2 = ((char2 & 15) << 4) | (char3 >> 2);
+    const byte3 = ((char3 & 3) << 6) | char4;
+
+    result += String.fromCharCode(byte1);
+
+    if (char3 !== 64) {
+      result += String.fromCharCode(byte2);
+    }
+    if (char4 !== 64) {
+      result += String.fromCharCode(byte3);
+    }
+  }
+  return result;
+};
+
+export default customAtob;

package/lib/public/src/utils/Security/utils/caseInsensitive.ts

@@ -0,0 +1,25 @@
+// 大小写不敏感函数
+
+/**
+ * 获取对象属性值，忽略大小写
+ * @param data 待获取数据的对象数据
+ * @param attr 属性名称
+ * @returns
+ */
+export const getObjectValue = (data: Record<any, any>, attr: string): any => {
+  if (typeof attr === 'undefined' || typeof data === 'undefined')
+    return undefined;
+  // 优先通过attr直接获取数据，如果数据不存在，则进行小写转换再获取
+  let result = data[attr];
+  if (typeof result === 'undefined') {
+    const lowerAttr = attr.toLowerCase();
+    const objectKeys = Object.keys(data);
+    for (let i = 0; i < objectKeys.length; i += 1) {
+      if (objectKeys[i].toLowerCase() === lowerAttr) {
+        result = data[objectKeys[i]];
+        break;
+      }
+    }
+  }
+  return result;
+};

package/lib/public/src/utils/Security/utils/check.ts

@@ -3,7 +3,6 @@ import { MODE } from '../types';
 
 const signModes: string[] = [
   MODE.SIGN,
-  MODE.SIGN_KEY,
   MODE.SIGN_UUID,
   MODE.SIGN_UUID_WITHOUT_SALT,
   MODE.SIGN_WITHOUT_SALT,
@@ -11,28 +10,53 @@ const signModes: string[] = [
 ];
 const signModesWithSalt: string[] = [
   MODE.SIGN,
-  MODE.SIGN_KEY,
   MODE.SIGN_UUID,
   MODE.SIGN_WITH_TIME,
 ];
-const encryptionModes: string[] = [MODE.AES, MODE.DES, MODE.RSA];
+const encryptionModes: string[] = [MODE.AES, MODE.RSA];
 
+/**
+ * 检查安全模式是否为加签
+ * @param mode 模式值
+ * @returns boolean
+ */
 export const checkIsSignMode = (mode: string): boolean => {
   return signModes.includes(mode);
 };
 
+/**
+ * 检查安全模式是否为加签(带盐值)
+ * @param mode 模式值
+ * @returns boolean
+ */
 export const checkIsSignWithSalt = (mode: string): boolean => {
   return signModesWithSalt.includes(mode);
 };
 
+/**
+ * 检查安全模式是否为加密
+ * @param mode 模式值
+ * @returns boolean
+ */
 export const checkIsEncryption = (mode: string): boolean => {
   return encryptionModes.includes(mode);
 };
 
+/**
+ * 检查安全模式是否为合法值
+ * @param mode 模式值
+ * @returns boolean
+ */
 export const checkIsModeValue = (mode: string): boolean => {
   return signModes.includes(mode) || encryptionModes.includes(mode);
 };
 
+/**
+ * 检查当前请求是否需要忽略
+ * @param url 请求地址
+ * @param options 请求参数
+ * @returns boolean
+ */
 export const checkIsUrlIgnore = (
   url: string,
   options?: { headers?: any; body?: any; method?: string },

package/lib/public/src/utils/Security/utils/cookie.ts

@@ -1,70 +1,118 @@
-import capabilities from '../clientCapabilities';
-import message from './message';
-
-const showError = () => message.warn('[lcdp-security]: 当前环境不支持cookie');
-
 const CookieUtil = {
-  get(name: string) {
-    if (!capabilities.cookie) {
-      showError();
-      return null;
-    }
-    const cookieName: string = `${encodeURIComponent(name)}=`;
-    const cookieStart: number = document.cookie.indexOf(cookieName);
-    let cookieValue: string | null = null;
-    let cookieEnd: number;
-
-    if (cookieStart > -1) {
-      cookieEnd = document.cookie.indexOf(';', cookieStart);
-      if (cookieEnd === -1) {
-        cookieEnd = document.cookie.length;
-      }
-      cookieValue = decodeURIComponent(
-        document.cookie.substring(cookieStart + cookieName.length, cookieEnd),
-      );
-    }
-
-    return cookieValue;
+  /**
+   * 获取cookie值
+   * @param key cookie字段名称
+   * @returns cookie值
+   */
+  getItem(key: string) {
+    return (
+      decodeURIComponent(
+        document.cookie.replace(
+          new RegExp(
+            `(?:(?:^|.*;)\\s*${encodeURIComponent(key).replace(
+              /[-.+*]/g,
+              '\\$&',
+            )}\\s*\\=\\s*([^;]*).*$)|^.*$`,
+          ),
+          '$1',
+        ),
+      ) || null
+    );
   },
 
-  set(
-    name: string,
+  /**
+   * 设置cookie值
+   * @param key cookie字段名称
+   * @param value 值
+   * @param end 有效结束事件
+   * @param path 作用域-路径
+   * @param domain 作用域-域名
+   * @param secure 是否只通过 https 协议传输
+   * @returns 设置成功返回true，设置失败返回false
+   */
+  setItem(
+    key: string,
     value: string,
-    expires: Date,
-    path: string,
-    domain: string,
-    secure: boolean,
+    end?: any,
+    path?: string,
+    domain?: string,
+    secure?: boolean,
   ) {
-    if (!capabilities.cookie) {
-      showError();
-      return;
-    }
-    let cookieText = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
-
-    if (expires instanceof Date) {
-      cookieText += `; expires=${expires.toUTCString()}`;
-    }
-
-    if (path) {
-      cookieText += `; path=${path}`;
+    if (!key || /^(?:expires|max\-age|path|domain|secure)$/i.test(key)) {
+      return false;
     }
-
-    if (domain) {
-      cookieText += `; domain=${domain}`;
+    let expires = '';
+    if (end) {
+      switch (end.constructor) {
+        case Number:
+          expires =
+            end === Infinity
+              ? '; expires=Fri, 31 Dec 9999 23:59:59 GMT'
+              : `; max-age=${end}`;
+          break;
+        case String:
+          expires = `; expires=${end}`;
+          break;
+        case Date:
+          expires = `; expires=${end.toUTCString()}`;
+          break;
+        default:
+          break;
+      }
     }
+    document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(
+      value,
+    )}${expires}${domain ? `; domain=${domain}` : ''}${
+      path ? `; path=${path}` : ''
+    }${secure ? '; secure' : ''}`;
+    return true;
+  },
 
-    if (secure) {
-      cookieText += '; secure';
+  /**
+   * 删除cookie指定项
+   * @param key cookie字段名称
+   * @param path cookie所在作用域-路径
+   * @param domain cookie所在作用域-域名
+   * @returns 删除成功返回true，删除失败返回false
+   */
+  removeItem(key: string, path?: string, domain?: string) {
+    if (!key || !this.hasItem(key)) {
+      return false;
     }
+    document.cookie = `${encodeURIComponent(
+      key,
+    )}=; expires=Thu, 01 Jan 1970 00:00:00 GMT${
+      domain ? `; domain=${domain}` : ''
+    }${path ? `; path=${path}` : ''}`;
+    return true;
+  },
 
-    document.cookie = cookieText;
+  /**
+   * 是否包含cookie项
+   * @param key cookie字段名称
+   * @returns 存在返回true，不存在返回false
+   */
+  hasItem(key: string) {
+    return new RegExp(
+      `(?:^|;\\s*)${encodeURIComponent(key).replace(/[-.+*]/g, '\\$&')}\\s*\\=`,
+    ).test(document.cookie);
   },
 
-  unset(name: string, path: string, domain: string, secure: boolean) {
-    this.set(name, '', new Date(0), path, domain, secure);
+  /**
+   * 获取cookie里所有字段名称
+   * @returns 字段名称列表
+   */
+  keys() {
+    const aKeys = document.cookie
+      .replace(/((?:^|\s*;)[^\=]+)(?=;|$)|^\s*|\s*(?:\=[^;]*)?(?:\1|$)/g, '')
+      .split(/\s*(?:\=[^;]*)?;\s*/);
+    for (let nIdx = 0; nIdx < aKeys.length; nIdx += 1) {
+      aKeys[nIdx] = decodeURIComponent(aKeys[nIdx]);
+    }
+    return aKeys;
   },
 };
 
-export const getSaltValue = (saltKey: string) => CookieUtil.get(saltKey);
+export const getSaltValue = (saltKey: string) => CookieUtil.getItem(saltKey);
 
 export default CookieUtil;

package/lib/public/src/utils/Security/utils/encrypted.ts

@@ -2,9 +2,14 @@ import config from '../config';
 import { lxKey } from '../const';
 import { AESDecrypt, AESEncrypt } from '../encipher/aes';
 import { RSADecrypt, RSAEncrypt } from '../encipher/rsa';
-import { MODE } from '../types';
-import message from './message';
+import { MODE, requester } from '../types';
+import { getObjectValue } from './caseInsensitive';
 
+/**
+ * 预置内部加密函数，将秘钥进行加密使用
+ * @param str 待加密内容
+ * @returns
+ */
 export function lxEncrypt(str: string) {
   if (config.keyEncrypt) {
     return AESEncrypt(str, lxKey) || str;
@@ -12,6 +17,11 @@ export function lxEncrypt(str: string) {
   return str;
 }
 
+/**
+ * 预置内部解密函数
+ * @param str 待加密内容
+ * @returns
+ */
 function lxDecrypt(str: string) {
   if (config.keyEncrypt) {
     return AESDecrypt(str, lxKey) || str;
@@ -19,6 +29,12 @@ function lxDecrypt(str: string) {
   return str;
 }
 
+/**
+ * 统一加密函数
+ * @param str 待加密内容
+ * @param type 加密类型
+ * @returns string 加密后内容
+ */
 export function encryptedStr(str: string, type: string): string {
   if (type === MODE.AES) {
     return AESEncrypt(
@@ -36,17 +52,17 @@ export function encryptedStr(str: string, type: string): string {
       ) || ''
     );
   }
-  if (type === MODE.DES) {
-    message.warn('DES encryption is no longer supported');
-  }
   return str;
 }
 
-export function decryptedStr(
-  str: string,
-  type: string,
-  config: any = {},
-): string {
+/**
+ * 统一解密函数
+ * @param str 待解密内容
+ * @param type 加密类型
+ * @param config 配置项(自定义秘钥和解密方法)
+ * @returns string 解密后的内容
+ */
+export function decryptedStr(str: string, type: string): string {
   if (type === MODE.AES) {
     return AESDecrypt(
       str,
@@ -63,59 +79,190 @@ export function decryptedStr(
       ) || ''
     );
   }
-  if (type === MODE.DES) {
-    message.warn('DES encryption is no longer supported');
-  }
   return str;
 }
 
+/**
+ * 将url参数加密，如： a=1&b=2 -> a=XAZYt1dl43v0gYUlNM6wEg%3D%3D&b=rbsCqzqEZvsUn41oxNsJ%2FQ%3D%3D
+ * @param search url参数, 如: a=1&b=2
+ * @param mode 加密模式
+ * @returns string 加密后数据
+ */
+export const encryptedStrForSearchParams = (
+  search: string,
+  mode: '2.0' | '3.0',
+) => {
+  const params = search.split('&').map((param) => {
+    const [k, v] = param.split('=');
+    return `${encodeURIComponent(k)}=${encodeURIComponent(
+      encryptedStr(v, mode),
+    )}`;
+  });
+  return params.join('&');
+};
+
+/**
+ * 将url参数解密
+ * @param search url参数, 如: a=XAZYt1dl43v0gYUlNM6wEg%3D%3D&b=rbsCqzqEZvsUn41oxNsJ%2FQ%3D%3D
+ * @param mode 加密模式
+ * @returns string 解密后数据
+ */
+export const decryptedStrForSearchParams = (
+  search: string,
+  mode: '2.0' | '3.0',
+) => {
+  const params = search.split('&').map((param) => {
+    const [k, v] = param.split('=');
+    return `${decodeURIComponent(k)}=${decryptedStr(
+      decodeURIComponent(v),
+      mode,
+    )}`;
+  });
+  return params.join('&');
+};
+
+/**
+ * 将对象数据value字段加密， 如: { a: 1, b: 2 } -> { a: 'XAZYt1dl43v0gYUlNM6wEg', b: 'XAZYt1dl43v0gYUlNM6wEg' }
+ * @param data 对象数据
+ * @param mode 加密模式
+ * @returns string 加密后数据
+ */
+const encryptedStrForObjectBody = (
+  data: Record<any, any>,
+  mode: '2.0' | '3.0',
+) => {
+  return Object.keys(data).reduce(
+    (
+      previousValue: Record<string, string>,
+      key: string,
+    ): Record<string, string> => {
+      if (typeof data[key] === 'object') {
+        previousValue[key] = encryptedStr(JSON.stringify(data[key]), mode);
+      } else {
+        previousValue[key] = encryptedStr(String(data[key]), mode);
+      }
+      return previousValue;
+    },
+    {},
+  );
+};
+
 interface optsType {
   body?: any;
   headers?: any;
 }
 type returnType = [string, { body?: any; headers?: any }];
 
-// 统一请求参数加密
+/**
+ * 统一请求参数加密，对url参数、body参数进行加密
+ * @param url 请求url地址
+ * @param opts 请求配置，包含 headers、body
+ * @param mode 加密模式，2.0:rsa，3.0:aes
+ * @param requester 请求程序，"fetch" | "xhr" | "wxRequest"
+ * @returns [加密处理后的url， 加密处理后的数据(header、body)]
+ */
 export const encryptedRequestParams = (
   url: string,
   opts: optsType,
-  type: string,
+  mode: '2.0' | '3.0',
+  requester: requester,
 ): returnType => {
-  const isFormData = opts.body instanceof FormData;
+  const encryptedOpts = Object.assign({}, opts);
 
-  // search 部分加密
+  // 在请求头增加‘模式’字段，告知后端解密方式
+  encryptedOpts.headers = {
+    ...(opts.headers || {}),
+    [config.securityHeaderKey as string]: mode,
+  };
+
+  // url search 部分参数加密
   const encryptedUrl =
     url.indexOf('?') !== -1
-      ? url.replace(/[^?]+$/g, (search: string) => {
-          const params = search.split('&').map((param) => {
-            const [k, v] = param.split('=');
-            return `${encodeURIComponent(k)}=${encodeURIComponent(
-              encryptedStr(v, type),
-            )}`;
-          });
-          return params.join('&');
-        })
+      ? url.replace(/[^?]+$/g, (data) =>
+          encryptedStrForSearchParams(data, mode),
+        )
       : url;
 
-  // body参数加密
-  const encryptedOpts = Object.assign({}, opts);
-  encryptedOpts.headers = {
-    ...(opts.headers || {}),
-    [config.securityHeaderKey as string]: type,
-  };
+  /**
+   * body参数加密
+   * body 数据类型：
+   * - Fetch:  a string | ArrayBuffer | Blob | DataView | File | FormData | TypedArray | URLSearchParams  see: https://developer.mozilla.org/en-US/docs/Web/API/RequestInit#body
+   * - XHR: a string | Blob | FormData | URLSearchParams | Document | null see: https://developer.mozilla.org/zh-CN/docs/Web/API/XMLHttpRequest/send
+   * - wx.request: a string | object | ArrayBuffer see: https://developers.weixin.qq.com/miniprogram/dev/api/network/request/wx.request.html
+   *
+   * 入参数据为: opts.body, 数据来源于
+   * fetch请求的 options.body
+   * xhr请求 send方法入参
+   * wx请求的 options.data
+   *
+   * 加密原则：
+   * 1. 对于表单数据只加密value部分
+   * 2. json或文本类型整个body加密
+   * 3. 其他类型(File、Blob...)不加密
+   */
+  if (opts.body) {
+    const defaultContentType: Record<requester, string> = {
+      xhr: 'application/x-www-form-urlencoded',
+      fetch: 'text/plain',
+      wxRequest: 'application/json',
+    };
+    const contentType =
+      getObjectValue(opts.headers, 'Content-Type') ||
+      defaultContentType[requester];
+    const method = opts.headers?.method?.toUpperCase() || 'GET';
+    const isFormData =
+      typeof FormData !== 'undefined' && opts.body instanceof FormData;
+    const isURLSearchParams =
+      typeof URLSearchParams !== 'undefined' &&
+      opts.body instanceof URLSearchParams;
 
-  if (isFormData) {
-    // formData 加密
-    const formData = new FormData();
-    const reqBody = opts.body;
-    for (const key of (reqBody as any).keys()) {
-      const value = reqBody.get(key);
-      formData.append(key, encryptedStr(value, type));
+    /* 1. 优先根据body数据类型来处理 */
+    if (isFormData || isURLSearchParams) {
+      const newObjData = isFormData ? new FormData() : new URLSearchParams();
+      const reqBody = opts.body;
+      for (const key of (reqBody as any).keys()) {
+        const value = reqBody.get(key);
+        // 只加密文本类型数据，文件数据不处理
+        if (typeof value === 'string') {
+          newObjData.append(key, encryptedStr(value, mode));
+        } else {
+          newObjData.append(key, value as any);
+        }
+      }
+      encryptedOpts.body = newObjData;
+    } /* 2. 根据contentType类型来处理 */ else if (
+      contentType.indexOf('application/json') !== -1
+    ) {
+      // wx.request 可以为对象类型
+      if (typeof opts.body === 'object') {
+        try {
+          if (method === 'GET') {
+            // get请求时，body数据将通过url参数传递
+            encryptedOpts.body = encryptedStrForObjectBody(opts.body, mode);
+          } else {
+            encryptedOpts.body = encryptedStr(JSON.stringify(opts.body), mode);
+          }
+        } catch {
+          encryptedOpts.body = opts.body;
+        }
+      } else {
+        encryptedOpts.body = encryptedStr(opts.body, mode);
+      }
+    } else if (
+      contentType.indexOf('application/x-www-form-urlencoded') !== -1
+    ) {
+      if (typeof opts.body === 'object') {
+        encryptedOpts.body = encryptedStrForObjectBody(opts.body, mode);
+      } else {
+        encryptedOpts.body = encryptedStrForSearchParams(opts.body, mode);
+      }
+    } else if (typeof opts.body === 'string') {
+      //  文本数据 加密
+      encryptedOpts.body = encryptedStr(opts.body, mode);
+    } else {
+      // 其他类型数据不处理
+      encryptedOpts.body = opts.body;
     }
-    encryptedOpts.body = formData;
-  } else if (opts.body) {
-    //  文本加密
-    encryptedOpts.body = encryptedStr(opts.body, type);
   }
 
   return [encryptedUrl, encryptedOpts];