@lingxiteam/ebe-utils 0.0.33 → 0.0.37

package/lib/public/src/utils/Security/const.ts

@@ -1,129 +1,40 @@
 // 不建议使用环境变量，后期通一通过config来配置
 // 兼容非node环境构建(如：小程序)
-if (typeof process === 'undefined') {
-  // eslint-disable-next-line no-global-assign
-  process = { env: {} } as any;
-}
-
-const defaultAESKey = [
-  'd',
-  '8',
-  '6',
-  'd',
-  '7',
-  'b',
-  'a',
-  'b',
-  '3',
-  'd',
-  '6',
-  'a',
-  'c',
-  '0',
-  '1',
-  'a',
-].join('');
-const defaultDESKey = ['9', '1', 'T', 'H', 'R', 'A', 'B', 'Y'].join('');
-const defaultSignHeaderKey = 'X-SIGN';
-
-export const lxKey = [
-  'd',
-  '8',
-  '6',
-  'd',
-  '7',
-  'b',
-  'a',
-  'b',
-  '3',
-  'd',
-  '6',
-  'a',
-  'c',
-  '0',
-  'I',
-  'a',
-].join('');
-
-export const securityHeaderKey = 'XA-TYPE';
-
-export const signSaltKey =
-  process.env.LING_XI_USER_KEY_IN_COOKIE || 'X-LX-N-ID';
-
-export const signKey =
-  process.env.LING_XI_HTTP_SIGN_KEY ||
-  [
-    'z',
-    'r',
-    'T',
-    '5',
-    'b',
-    'i',
-    '2',
-    'e',
-    's',
-    'c',
-    'X',
-    'i',
-    'l',
-    'a',
-    'H',
-    '1',
-    'f',
-    's',
-    '6',
-    '5',
-    '3',
-    'u',
-    'Z',
-    'i',
-    'H',
-    '9',
-    'R',
-    'W',
-    'f',
-    'z',
-    'C',
-    'S',
-  ].join('');
-
-export const signHeaderKey =
-  process.env.LINGXI_HTTP_SIGN_HEADER_KEY ||
-  process.env.REACT_APP_HTTP_SIGN_HEADER_KEY ||
-  process.env.UMI_APP_HTTP_SIGN_HEADER_KEY ||
-  process.env.FISHX_APP_HTTP_SIGN_HEADER_KEY ||
-  defaultSignHeaderKey;
-
-export const rsaPublicKey =
-  process.env.LINGXI_HTTP_RSA_PUBLIC_KEY ||
-  process.env.REACT_APP_HTTP_RSA_PUBLIC_KEY ||
-  process.env.UMI_APP_HTTP_RSA_PUBLIC_KEY ||
-  process.env.FISHX_APP_HTTP_RSA_PUBLIC_KEY;
-
-export const rsaPrivKey =
-  process.env.LINGXI_HTTP_RSA_PRIV_KEY ||
-  process.env.REACT_APP_HTTP_RSA_PRIV_KEY ||
-  process.env.UMI_APP_HTTP_RSA_PRIV_KEY ||
-  process.env.FISHX_APP_HTTP_RSA_PRIV_KEY;
-
-export const aesKey =
-  process.env.LINGXI_HTTP_AES_KEY ||
-  process.env.REACT_APP_HTTP_AES_KEY ||
-  process.env.UMI_APP_HTTP_AES_KEY ||
-  process.env.FISHX_APP_HTTP_AES_KEY ||
-  defaultAESKey;
-
-export const desKey =
-  process.env.LINGXI_HTTP_DES_KEY ||
-  process.env.REACT_APP_HTTP_DES_KEY ||
-  process.env.UMI_APP_HTTP_DES_KEY ||
-  process.env.FISHX_APP_HTTP_DES_KEY ||
-  defaultDESKey;
-
-export default {
-  signKey,
-  rsaPublicKey,
-  rsaPrivKey,
-  aesKey,
-  desKey,
-};
+// const _process = typeof process === 'undefined' ? { env: {} } as any : process;
+import customAtob from './utils/atob';
+
+export const reqIdKey = 'reqid';
+
+export const commonGlobal: any = (function () {
+  // nodejs、wx、electron 环境(在wx和electron同时具备global和window，wx下写入的全局变量在global里，故优先使用global)
+  if (typeof global !== 'undefined') {
+    return global;
+  }
+  // 使用标准的方式来获取不同环境下的全局 this 对象
+  if (typeof globalThis !== 'undefined') {
+    return globalThis;
+  }
+  // 浏览器环境
+  if (typeof window !== 'undefined') {
+    return window;
+  }
+  // Workers环境
+  if (typeof self !== 'undefined') {
+    return self;
+  }
+  return {};
+})();
+
+// 'd86d7bab3d6ac01a,X-SIGN,d86d7bab3d6ac0Ia,XA-TYPE,X-LX-N-ID,zrT5bi2escXilaH1fs653uZiH9RWfzCS'
+const k = customAtob(
+  'ZDg2ZDdiYWIzZDZhYzAxYSxYLVNJR04sZDg2ZDdiYWIzZDZhYzBJYSxYQS1UWVBFLFgtTFgtTi1JRCx6clQ1YmkyZXNjWGlsYUgxZnM2NTN1WmlIOVJXZnpDUw==',
+).split(',');
+
+export const aesKey = k[0];
+export const signHeaderKey = k[1];
+export const lxKey = k[2];
+export const securityHeaderKey = k[3];
+export const signSaltKey = k[4];
+export const signKey = k[5];
+export const rsaPublicKey = k[6];
+export const rsaPrivKey = k[7];

package/lib/public/src/utils/Security/debug/data.ts

@@ -0,0 +1,86 @@
+import { commonGlobal } from '../const';
+import message from '../utils/message';
+import generateRandomNumber from '../utils/random';
+
+export type configTpe = {
+  globalAccess?: boolean;
+  storeMax?: number;
+};
+
+/**
+ * 存储每个请求的签名/加密数据
+ * 目前仅支持通过localStorage来开启数据记录，避免误将setConfig设置的debug发到生产环境
+ * 通过拷贝请求头里获取 reqid,在控制台粘贴该信息进行查看调试数据
+ */
+class DebugDataStore {
+  private tag: string = '';
+
+  private config: configTpe = {};
+
+  private data: Record<string, any> = {};
+
+  private storeAllKeys: string[] = [];
+
+  private storeActiveKeys: string[] = [];
+
+  constructor(config: configTpe = {}) {
+    this.config = Object.assign(
+      {
+        globalAccess: true,
+        storeMax: 20,
+      },
+      config,
+    );
+
+    this.tag = `LXREQ${generateRandomNumber(2)}`;
+
+    const _this = this;
+
+    if (this.config.globalAccess) {
+      commonGlobal[this.tag] = new Proxy(this.data, {
+        get(target, props) {
+          if (typeof props === 'string') {
+            if (props === 'toJSON') {
+              return '{}';
+            }
+            return _this.getData(`${_this.tag}.${props}`);
+          }
+          return {};
+        },
+      });
+    }
+  }
+
+  public createId() {
+    return `${this.tag}.T${generateRandomNumber(2)}${Date.now()}`;
+  }
+
+  public store(id: string, key: string, value: any) {
+    const _id = id.replace(/(window|global|self|globalThis)\./g, '');
+    if (!this.storeAllKeys.includes(_id)) {
+      this.data[_id] = { [key]: value };
+      this.storeAllKeys.push(_id);
+      this.storeActiveKeys.push(_id);
+      if (
+        this.config.storeMax &&
+        this.storeActiveKeys.length > this.config.storeMax
+      ) {
+        const delkey = this.storeActiveKeys.shift();
+        if (delkey) {
+          delete this.data[delkey];
+        }
+      }
+    } else {
+      this.data[_id] = Object.assign(this.data[_id], { [key]: value });
+    }
+  }
+
+  public getData(id: string) {
+    if (this.storeAllKeys.includes(id) && !this.storeActiveKeys.includes(id)) {
+      message.warn('数据已失效');
+    }
+    return this.data[id];
+  }
+}
+
+export default DebugDataStore;

package/lib/public/src/utils/Security/debug/index.ts

@@ -0,0 +1,21 @@
+import storageUtil from '../utils/storge';
+import type { configTpe } from './data';
+import DebugDataStore from './data';
+
+// 通过本地存储的参数开启调试
+export const isAvailable = !!storageUtil.get('lxDebug');
+
+const debug = (() => {
+  if (isAvailable) {
+    let lxDebug = storageUtil.get('lxDebug');
+    try {
+      lxDebug = JSON.parse(lxDebug as string);
+    } catch {
+      lxDebug = 'true';
+    }
+    return new DebugDataStore(lxDebug === 'true' ? {} : (lxDebug as configTpe));
+  }
+  return null;
+})();
+
+export default debug;

package/lib/public/src/utils/Security/encipher/sign.ts

@@ -2,15 +2,12 @@
 import { SHA256 } from 'crypto-js';
 import { v4 as uuidv4 } from 'uuid';
 import config from '../config';
-import { aesKey, securityHeaderKey, signHeaderKey } from '../const';
+import { aesKey, reqIdKey } from '../const';
+import debug from '../debug';
 import { MODE, signHttpOptionsType } from '../types';
 import { checkIsSignMode } from '../utils/check';
 import message from '../utils/message';
-import {
-  decodeQueryString,
-  obj2QueryString,
-  removeURLParameters,
-} from '../utils/url';
+import { decodeQueryString, obj2QueryString } from '../utils/url';
 import { AESEncrypt } from './aes';
 
 // 注意：修改此文件请跑测试用例, npm run test
@@ -37,7 +34,7 @@ import { AESEncrypt } from './aes';
 
 // 由于X-B 的规则可能被业务网关使用，并往请求头增加内容，导致前后端加密不一致
 // 2022.08.09 使用以下3个固定值 + X-LX-*匹配 方式
-const hKeys = ['X-B-AUTH', 'X-B-TARGET-ID', 'APP-ID'];
+const hKeys = ['x-b-auth', 'x-b-target-id', 'app-id'];
 
 // 获取接口路径,2023-03-16调整，由于网关配置问题可能导致前后端取的服务地址不一致，调整后只取最后一级
 const getApiPath = (url: string) => {
@@ -72,13 +69,16 @@ export const createHttpSignStr = (
   let headerParams = '';
   const headersKeyArr: any = [];
   if (headers) {
-    Object.keys(headers)
-      .concat(config.sign?.includeHeaders || [])
-      .forEach((key) => {
-        if (key.startsWith('X-LX-') || hKeys.includes(key)) {
-          headersKeyArr.push(`${key.toLowerCase()}=${headers[key]}`);
-        }
-      });
+    const includesHeaderKeys =
+      config.sign?.headerKeys?.map((item) => item.toLowerCase()) || hKeys;
+    Object.keys(headers).forEach((key) => {
+      if (
+        key.startsWith('X-LX-') ||
+        includesHeaderKeys.includes(key.toLowerCase())
+      ) {
+        headersKeyArr.push(`${key.toLowerCase()}=${headers[key]}`);
+      }
+    });
   }
   headerParams = headersKeyArr.sort().join(';');
 
@@ -87,10 +87,11 @@ export const createHttpSignStr = (
   // body为空时，可能出现前后端取值不一致问题。
   // nodejs 一般存在空字符串、空对象、undefined、空表单 等，取决于框架处理和使用的中间件
   // java后端一般为null
+  // 目前与后端约定默认为空字符串
   let finallyBody = body;
-  if (typeof config.emptyBodyValue !== 'undefined') {
+  if (body === undefined || body === null) {
     finallyBody =
-      body === undefined || body === null ? config.emptyBodyValue : body;
+      typeof config.emptyBodyValue !== 'undefined' ? config.emptyBodyValue : '';
   }
   if (method.toLowerCase() === 'get') {
     // 为保证与后端值一致此处需要将数据进行解码
@@ -114,7 +115,6 @@ export const createHttpSignStr = (
   let result: string = '';
   switch (signVersion) {
     case MODE.SIGN:
-    case MODE.SIGN_KEY:
       content = [
         apiPath,
         headerParams,
@@ -165,48 +165,17 @@ export const createHttpSignStr = (
     message.log('url', url);
     message.log('str', content);
     message.log('sign', result);
+
+    if (headers?.[reqIdKey] && debug) {
+      debug.store(headers[reqIdKey], 'modeRequest', signVersion);
+      debug.store(headers[reqIdKey], 'url', url);
+      debug.store(headers[reqIdKey], 'str', content);
+      debug.store(headers[reqIdKey], 'sign', result);
+    }
   }
 
   // 返回约定签名
   return result;
 };
 
-// 由于（img、script）无法进行处理请求头，将签名参数x-sign放到url参数里
-export const buildXSignUrl = (
-  url: string,
-  options: signHttpOptionsType = {},
-  version?: any,
-) => {
-  if (!url) {
-    return '';
-  }
-  if (version && !checkIsSignMode(version)) {
-    message.warn(`不支持[${version}]签名模式`);
-    return url;
-  }
-  let _url = url;
-  const signVersion =
-    version || checkIsSignMode(config.mode as MODE)
-      ? config.mode
-      : MODE.SIGN_WITH_TIME;
-  const signStr = createHttpSignStr(
-    url,
-    { method: 'GET', ...options },
-    signVersion,
-  );
-  // 如果url上存在签名则移除原签名
-  if (
-    url.indexOf(signHeaderKey) !== -1 ||
-    url.indexOf(securityHeaderKey) !== -1
-  ) {
-    _url = removeURLParameters(url, [signHeaderKey, securityHeaderKey]);
-  }
-  return `${_url}${
-    _url.includes('?') ? '&' : '?'
-  }${signHeaderKey}=${signStr}&${securityHeaderKey}=${signVersion}`;
-};
-
-// buildXSignUrl兼容平台内部使用，外部使用createHttpSignWithUrl
-export const createHttpSignWithUrl = buildXSignUrl;
-
-export default { createHttpSignStr, createHttpSignWithUrl };
+export default { createHttpSignStr };

package/lib/public/src/utils/Security/html.ts

@@ -0,0 +1,52 @@
+import type { securityType } from './types';
+
+/**
+ * 移除内容里恶意html代码(xss攻击)
+ * @param str 待处理html内容
+ * @param options 可选配置项
+ * @return 安全的html片段
+ */
+const safeHTML: typeof securityType.html.safeHTML = (str, options) => {
+  if (typeof str !== 'string') return str || '';
+  const blacklist = options?.blackList || ['script', 'style', 'iframe'];
+
+  // 创建一个新的 DOM 解析器对象
+  const parser = new DOMParser();
+
+  // 使用 parseFromString 方法将 HTML 片段转换为 DOM 对象
+  const doc = parser.parseFromString(str, 'text/html');
+
+  // 遍历 DOM 树并删除恶意节点
+  function cleanNode(node: Element) {
+    if (node.nodeType === 1) {
+      // 元素节点
+      if (blacklist.indexOf(node.nodeName.toLowerCase()) !== -1) {
+        node.parentNode?.removeChild(node);
+        return;
+      }
+
+      // 移除元素节点上所有事件属性
+      for (let i = node.attributes.length - 1; i >= 0; i -= 1) {
+        const attr = node.attributes[i];
+        if (
+          attr.name.startsWith('on') ||
+          String(node.getAttribute(attr.name))
+            .toLowerCase()
+            .indexOf('javascript:') !== -1
+        ) {
+          node.removeAttribute(attr.name);
+        }
+      }
+    }
+
+    for (let i = 0; i < node.childNodes.length; i += 1) {
+      cleanNode(node.childNodes[i] as Element);
+    }
+  }
+  cleanNode(doc.body);
+  return doc.body.innerHTML;
+};
+
+export default {
+  safeHTML,
+};

package/lib/public/src/utils/Security/httpEncryption.ts

@@ -4,14 +4,8 @@
  * @Description: 一个简单的http请求安全加密处理
  */
 
-// TODO 支持XMLHttpRequest拦截、参数混淆、响应拦截
-
-// 使用方式1: 使用fetch请求模块，start({ mode: signKey })，适应经过封装的fetch模块
-// 使用方式2: 使用fetch请求模块，将window.fetch 替换成 fetch，适应自己封装的fetch模块
-// 使用方式3: 不使用fetch请求模块，使用createHttpSignStr自己获取签名，自行在header上添加参数
-import merge from 'merge';
-import capabilities from './clientCapabilities';
-import config, { createDefaultConfig, setConfig } from './config';
+import capabilities, { isBrowser } from './clientCapabilities';
+import config, { setConfig } from './config';
 import {
   conflict as conflictFetch,
   noConflict as noConflictFetch,
@@ -28,22 +22,48 @@ import type { configType } from './types';
 import { checkIsModeValue } from './utils/check';
 import message from './utils/message';
 
-let isHttpEncryption = false;
+// 在浏览器模式下可能由于多个子工程集成造成多次conflict引发异常，在浏览器里需要将开关配置全局化
+const _switch: Record<string, any> = {
+  _isHttpEncryption: false,
+};
+
+Object.defineProperty(
+  _switch,
+  'isHttpEncryption',
+  isBrowser
+    ? {
+        get() {
+          return (window as any).isLxHttpEncryption ?? this._isHttpEncryption;
+        },
+        set(value) {
+          (window as any).isLxHttpEncryption = value;
+          this._isHttpEncryption = value;
+        },
+      }
+    : {
+        get() {
+          return this._isHttpEncryption;
+        },
+        set(value) {
+          this._isHttpEncryption = value;
+        },
+      },
+);
+
 const noConflictList: Function[] = [];
 
 function start(startConfig?: configType) {
-  if (isHttpEncryption) {
-    message.warn('安全模式已开启,请使用stop方法停止后再重新开启');
-    return true;
+  if (_switch.isHttpEncryption) {
+    return null;
   }
 
-  const _startConfig = merge.recursive({}, createDefaultConfig(), startConfig);
-
-  const mode = _startConfig.mode as string;
-  if (checkIsModeValue(mode)) {
-    isHttpEncryption = true;
+  // const _startConfig = merge.recursive({}, createDefaultConfig(), startConfig);
+  const mode = startConfig?.mode;
+  // 如果存在设置mode，校验mode，如果为空时，使用config预置的
+  if (!mode || checkIsModeValue(mode)) {
+    _switch.isHttpEncryption = true;
     // 设置
-    setConfig(_startConfig);
+    setConfig(startConfig || {});
 
     // 按需启动请求劫持
     if (capabilities.fetch && config.requester?.includes('fetch')) {
@@ -58,15 +78,14 @@ function start(startConfig?: configType) {
       conflictWxRequest();
       noConflictList.push(noConflictWxRequest);
     }
-  } else {
-    message.error(`http安全开启失败,不支持${mode}模式`);
+    return true;
   }
-
-  return isHttpEncryption;
+  message.error(`http安全开启失败,不支持${mode}模式`);
+  return false;
 }
 
 function stop() {
-  isHttpEncryption = false;
+  _switch.isHttpEncryption = false;
   noConflictList.forEach((noConflict) => {
     noConflict();
   });

package/lib/public/src/utils/Security/index.ts

@@ -1,28 +1,36 @@
-import { setConfig } from './config';
-import KEYS from './const';
+import { getConfig, initConfig, setConfig } from './config';
 import { AESDecrypt, AESEncrypt } from './encipher/aes';
-import { DESDecrypt, DESEncrypt } from './encipher/des';
 import { RSADecrypt, RSAEncrypt } from './encipher/rsa';
-import { createHttpSignStr, createHttpSignWithUrl } from './encipher/sign';
+import { createHttpSignStr } from './encipher/sign';
 import { checkToken, generateToken } from './encipher/token';
+import html from './html';
 import httpEncryption from './httpEncryption';
+import {
+  autoSecurityWithUrl,
+  createEncryptedWithUrl,
+  createHttpSignWithUrl,
+} from './urlEncryption';
 import { lxEncrypt } from './utils/encrypted';
 
+export { aesKey, rsaPrivKey, rsaPublicKey, signKey } from './const';
+
 const security = {
   httpEncryption,
   createHttpSignStr,
   createHttpSignWithUrl,
+  createEncryptedWithUrl,
+  autoSecurityWithUrl,
   RSAEncrypt,
   RSADecrypt,
   AESEncrypt,
   AESDecrypt,
-  DESEncrypt,
-  DESDecrypt,
-  KEYS,
   checkToken,
   generateToken,
   setConfig,
+  getConfig,
+  initConfig,
   lxEncrypt,
+  html,
 };
 
 export default security;