@lingxiteam/ebe-utils 0.0.33 → 0.0.37

package/lib/public/src/utils/Security/requester/fetch.ts

@@ -1,5 +1,7 @@
 import capabilities from '../clientCapabilities';
 import config from '../config';
+import { commonGlobal, reqIdKey } from '../const';
+import debug from '../debug';
 import { createHttpSignStr } from '../encipher/sign';
 import {
   checkIsEncryption,
@@ -10,78 +12,102 @@ import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
 import message from '../utils/message';
 
 const originRequester: any = capabilities.fetch
-  ? (window || globalThis).fetch
+  ? commonGlobal.fetch
   : undefined;
 
 const fetch = (url: any, fetchOptions: any = {}): Promise<any> => {
   let requester: Promise<any>;
   const opts = { ...fetchOptions };
 
-  // 判定是否符合忽略规则
-  if (checkIsUrlIgnore(url, opts)) {
-    return originRequester(url, opts);
+  const securityHeaderKey = config.securityHeaderKey as string;
+
+  const debugId = debug?.createId();
+
+  if (debugId) {
+    opts.headers[reqIdKey] = debugId;
   }
 
-  // 请求头配置
-  // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
-  // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
-  // headers[securityHeaderKey] 指定当前服务安全模式
-  const securityHeaderKey = config.securityHeaderKey as string;
-  const modeInHeadParam = (opts.headers || {})[securityHeaderKey];
-
-  // 优先使用当前请求头指定的安全模式
-  const finallyMode = modeInHeadParam || config.mode;
-
-  // 通过请求头参数关闭当次安全模式
-  if (
-    String(modeInHeadParam) === 'false' ||
-    opts.headers?.disabledSignKey === true ||
-    opts.headers?.disabledEncrypted === true ||
-    finallyMode === false
-  ) {
-    // 不能直接删除，否则会导致disabledSignKey 这个节点删除了，第二次进来的时候导致异常
-    // const { disabledSignKey, ...resprops } = opts?.headers;
-    const _cloneHeader = Object.assign({}, opts.headers);
-    delete _cloneHeader.disabledSignKey;
-    delete _cloneHeader.disabledEncrypted;
-    delete _cloneHeader[securityHeaderKey];
-    requester = originRequester(url, { ...opts, headers: { ..._cloneHeader } });
-  } else if (checkIsSignMode(finallyMode)) {
-    // ------ 参数签名(默认) ------
-    const signValueKeyName = config.sign?.valueKeyName as string;
-    opts.headers = {
-      [securityHeaderKey]: finallyMode,
-      ...opts.headers,
-      [signValueKeyName]: createHttpSignStr(url, fetchOptions, finallyMode),
-    };
+  // 判定是否符合忽略规则
+  if (checkIsUrlIgnore(url, opts)) {
     requester = originRequester(url, opts);
-  } else if (checkIsEncryption(finallyMode)) {
-    // ------ 参数加密 ------
-    // search和body加密
-    const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
-      url,
-      opts,
-      finallyMode,
-    );
-
-    requester = originRequester(encryptedUrl, encryptedOpts);
   } else {
-    // 其他
-    requester = originRequester(url, opts);
+    // 请求头配置
+    // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
+    // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
+    // headers[securityHeaderKey] 指定当前服务安全模式
+    const modeInHeadParam = (opts.headers || {})[securityHeaderKey];
+
+    // 优先使用当前请求头指定的安全模式
+    const finallyMode = modeInHeadParam || config.mode;
+
+    // 通过请求头参数关闭当次安全模式
+    if (
+      String(modeInHeadParam) === 'false' ||
+      opts.headers?.disabledSignKey === true ||
+      opts.headers?.disabledEncrypted === true ||
+      finallyMode === false
+    ) {
+      // 不能直接删除，否则会导致disabledSignKey 这个节点删除了，第二次进来的时候导致异常
+      // const { disabledSignKey, ...resprops } = opts?.headers;
+      const _cloneHeader = Object.assign({}, opts.headers);
+      delete _cloneHeader.disabledSignKey;
+      delete _cloneHeader.disabledEncrypted;
+      delete _cloneHeader[securityHeaderKey];
+      requester = originRequester(url, {
+        ...opts,
+        headers: { ..._cloneHeader },
+      });
+    } else if (checkIsSignMode(finallyMode)) {
+      // ------ 参数签名(默认) ------
+      const signValueKeyName = config.sign?.valueKeyName as string;
+      opts.headers = {
+        [securityHeaderKey]: finallyMode,
+        ...opts.headers,
+        [signValueKeyName]: createHttpSignStr(url, fetchOptions, finallyMode),
+      };
+      requester = originRequester(url, opts);
+    } else if (checkIsEncryption(finallyMode)) {
+      // ------ 参数加密 ------
+      // search和body加密
+      const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
+        url,
+        opts,
+        finallyMode,
+        'fetch',
+      );
+
+      requester = originRequester(encryptedUrl, encryptedOpts);
+    } else {
+      // 其他
+      requester = originRequester(url, opts);
+    }
+
+    // 记录请求debug信息
+    if (debugId) {
+      debug?.store(debugId, 'modeRequest', finallyMode);
+      debug?.store(debugId, 'url', url);
+      try {
+        debug?.store(debugId, 'param', JSON.parse(opts.body));
+      } catch {
+        debug?.store(debugId, 'param', opts.body);
+      }
+    }
   }
 
   // ------ 响应解密 ------
   return requester.then(async (response: Response) => {
+    // headers.get对大小写不敏感
     const securityType = response.headers.get(securityHeaderKey);
 
     if (securityType && checkIsEncryption(securityType) && response.body) {
+      const contentType = response.headers.get('Content-Type');
       // 响应数据
       const respResult = await response.text();
 
       // 解密数据
       let result;
       try {
-        result = decryptedStr(respResult, securityType, config);
+        result = decryptedStr(respResult, securityType);
       } catch (e) {
         message.error('--------解密失败--------');
         // message.error(`请求ID：${reqId}`);
@@ -100,8 +126,14 @@ const fetch = (url: any, fetchOptions: any = {}): Promise<any> => {
         json = result;
         message.warn(`响应报文转换JSON失败, 内容为 ${result}`);
       }
+
+      // 记录响应debug信息
+      if (debugId) {
+        debug?.store(debugId, 'modeResopnse', securityType);
+        debug?.store(debugId, 'response', json);
+      }
       const blob = new Blob([JSON.stringify(json, null, 2)], {
-        type: 'application/json',
+        type: contentType || 'application/json',
       });
       return new Response(blob);
     }
@@ -109,11 +141,14 @@ const fetch = (url: any, fetchOptions: any = {}): Promise<any> => {
   });
 };
 
+// 标记劫持的fetch
+fetch.isLxSecurity = true;
+
 export const conflict = () => {
-  (window || globalThis).fetch = fetch;
+  commonGlobal.fetch = fetch;
 };
 export const noConflict = () => {
-  (window || globalThis).fetch = originRequester;
+  commonGlobal.fetch = originRequester;
 };
 
 export default fetch;

package/lib/public/src/utils/Security/requester/wx.ts

@@ -1,6 +1,9 @@
 import capabilities from '../clientCapabilities';
 import config from '../config';
+import { reqIdKey } from '../const';
+import debug from '../debug';
 import { createHttpSignStr } from '../encipher/sign';
+import { getObjectValue } from '../utils/caseInsensitive';
 import {
   checkIsEncryption,
   checkIsSignMode,
@@ -8,6 +11,7 @@ import {
   checkIsUrlIgnore,
 } from '../utils/check';
 import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
+import { addUrlParameters } from '../utils/url';
 
 const originRequester: any = capabilities.wxRequest ? wx.request : undefined;
 
@@ -27,6 +31,18 @@ const wxRequest = (
   }
 
   let requester;
+
+  // 记录原始请求数据，数据调试时查看
+  const originRequestData = opts.data;
+
+  // wx直接在控制台输入变量访问的是window下的变量，但js执行写入的变量在global，需特殊处理debugId
+  const debugId = `global.${debug?.createId()}`;
+  if (debugId) {
+    opts.header
+      ? (opts.header[reqIdKey] = debugId)
+      : (opts.header = { [reqIdKey]: debugId });
+  }
+
   // 请求头配置
   // headers.disabledSignKey 关闭签名(兼容，新模式通过将 securityHeaderKey设为false关闭)
   // headers.disabledEncrypted 关闭加密(兼容，新模式通过将 securityHeaderKey设为false关闭)
@@ -37,17 +53,22 @@ const wxRequest = (
   // 优先使用当前请求头指定的安全模式
   const finallyMode = modeInHeadParam || config.mode;
 
-  // 拦截success，处理解密
+  // 拦截success、fail，处理解密
   const originSuccess = opts.success;
   if (originSuccess) {
     const success: WechatMiniprogram.RequestSuccessCallback = (response) => {
-      const securityType = response.header[securityHeaderKey];
+      // wxrequest没有提供像 Headers.get 和 xhr.getResponseHeader 获取请求头信息(对大小写不敏感), 故此处需通过工具函数获取
+      const securityType = getObjectValue(response.header, securityHeaderKey);
       if (checkIsEncryption(securityType)) {
         let result;
         try {
           if (typeof response.data === 'string') {
-            result = decryptedStr(response.data, securityType, config);
-            if (response.header['content-type'] === 'application/json') {
+            result = decryptedStr(response.data, securityType);
+            if (
+              getObjectValue(response.header, 'Content-Type').indexOf(
+                'application/json',
+              ) !== -1
+            ) {
               result = JSON.parse(result);
             }
           }
@@ -55,6 +76,11 @@ const wxRequest = (
           response.data =
             typeof result === 'undefined' ? response.data : result;
         }
+        // 记录响应debug信息
+        if (debugId) {
+          debug?.store(debugId, 'modeResponse', securityType);
+          debug?.store(debugId, 'response', result);
+        }
       }
       originSuccess(response);
     };
@@ -81,11 +107,23 @@ const wxRequest = (
     opts.header = {
       ...(opts.header || {}),
       [securityHeaderKey]: finallyMode,
-      [signValueKeyName]: createHttpSignStr(
-        opts.url,
-        { method: opts.method, body: opts.data },
-        finallyMode,
-      ),
+      // 当get请求时，会将data拼装在url上，签名时需对url处理
+      [signValueKeyName]:
+        opts.method?.toLowerCase() === 'get' &&
+        Object.prototype.toString.call(opts.data) === '[object Object]'
+          ? createHttpSignStr(
+              addUrlParameters(
+                opts.url,
+                opts.data as WechatMiniprogram.IAnyObject,
+              ),
+              { method: opts.method, body: undefined, headers: opts.header },
+              finallyMode,
+            )
+          : createHttpSignStr(
+              opts.url,
+              { method: opts.method, body: opts.data, headers: opts.header },
+              finallyMode,
+            ),
     };
     // 后端根据cookie里的值进行校验
     if (checkIsSignWithSalt(finallyMode)) {
@@ -103,8 +141,12 @@ const wxRequest = (
     // search和body加密
     const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
       opts.url,
-      { body: opts.data, headers: opts.header },
+      {
+        body: opts.data,
+        headers: { method: opts.method, ...(opts.header || {}) },
+      },
       finallyMode,
+      'wxRequest',
     );
     opts.url = encryptedUrl;
     if (encryptedOpts.body) {
@@ -113,12 +155,19 @@ const wxRequest = (
     if (encryptedOpts.headers) {
       opts.header = encryptedOpts.headers;
     }
-    requester = originRequester(encryptedUrl, encryptedOpts);
+    requester = originRequester(opts);
   } else {
     // 其他
     requester = originRequester(opts);
   }
 
+  // 记录请求debug信息
+  if (debugId) {
+    debug?.store(debugId, 'modeRequest', finallyMode);
+    debug?.store(debugId, 'url', opts.url);
+    debug?.store(debugId, 'param', originRequestData);
+  }
+
   return requester;
 };
 

package/lib/public/src/utils/Security/requester/xhr.ts

@@ -1,11 +1,16 @@
+import capabilities from '../clientCapabilities';
 import config from '../config';
-// import { checkIsSignMode, checkIsEncryption, checkIsUrlIgnore, checkIsSignWithSalt } from '../utils/check';
+import { commonGlobal, reqIdKey } from '../const';
+import debug from '../debug';
 import { createHttpSignStr } from '../encipher/sign';
-import { checkIsUrlIgnore } from '../utils/check';
-// import { encryptedRequestParams, decryptedStr } from '../utils/encrypted';
-import capabilities from '../clientCapabilities';
+import {
+  checkIsEncryption,
+  checkIsSignMode,
+  checkIsUrlIgnore,
+} from '../utils/check';
+import { decryptedStr, encryptedRequestParams } from '../utils/encrypted';
 
-const originRequester: any = capabilities.xhr ? XMLHttpRequest : undefined;
+const OriginRequester: any = capabilities.xhr ? XMLHttpRequest : undefined;
 
 // 从请求头中获取参数
 function getRequestHeaders(xhr: XMLHttpRequest) {
@@ -14,15 +19,16 @@ function getRequestHeaders(xhr: XMLHttpRequest) {
     .getAllResponseHeaders()
     .split('\n')
     .forEach((header) => {
-      const [key, value] = header.split(': ');
-      headers[key] = value;
+      if (header) {
+        const [key, value] = header.split(': ');
+        headers[key] = value;
+      }
     });
   return headers;
 }
 
 const xhr = function () {
-  // eslint-disable-next-line new-cap
-  const originXhr = new originRequester();
+  const instanceXhr = new OriginRequester();
 
   const securityHeaderKey = config.securityHeaderKey as string;
   const signValueKeyName = config.sign?.valueKeyName as string;
@@ -30,13 +36,16 @@ const xhr = function () {
   let finallyMode: any = config.mode;
   let xhrUrl: string = '';
   let xhrMethod: any = '';
+  const openOptions: any = {};
 
   // 用于存储请求头信息
   const requestHeaders: any = {};
 
-  // 劫持 open 方法
-  const originalOpen = originXhr.open;
-  originXhr.open = function (
+  const debugId = debug?.createId();
+
+  // 劫持: open 方法, 记录url、请求头等信息
+  const originalOpen = instanceXhr.open;
+  instanceXhr.open = function (
     method: string,
     url: string,
     async?: boolean,
@@ -46,16 +55,26 @@ const xhr = function () {
     // 记录url地址
     xhrUrl = url;
     xhrMethod = method;
+    openOptions.async = async;
+    openOptions.user = user;
+    openOptions.password = password;
     // 获取请求头中的参数
-    const _requestHeaders = getRequestHeaders(originXhr);
+    const _requestHeaders = getRequestHeaders(instanceXhr);
     Object.assign(requestHeaders, _requestHeaders);
-    // 调用原始的 open 方法
-    originalOpen.call(this, method, url, async, user, password);
+    // 调用原始的 open 方法（async不能为undefined，不然引起调用报错）
+    originalOpen.call(
+      this,
+      method,
+      url,
+      typeof async === 'undefined' ? true : async,
+      user,
+      password,
+    );
   };
 
-  // 劫持 setRequestHeader 方法
-  const originalSetRequestHeader = originXhr.setRequestHeader;
-  originXhr.setRequestHeader = function (
+  // 劫持: setRequestHeader 方法，记录请求头信息
+  const originalSetRequestHeader = instanceXhr.setRequestHeader;
+  instanceXhr.setRequestHeader = function (
     key: string,
     value: string | number | boolean,
   ) {
@@ -66,9 +85,10 @@ const xhr = function () {
     originalSetRequestHeader.call(this, key, value);
   };
 
-  // 劫持 send 方法
-  const originalSend = originXhr.send;
-  originXhr.send = function (data: any) {
+  // 劫持: send 方法，进行签名或加密处理
+  const originalSend = instanceXhr.send;
+
+  instanceXhr.send = function (data: any) {
     // 判定是否符合忽略规则
     if (
       checkIsUrlIgnore(xhrUrl, {
@@ -81,41 +101,175 @@ const xhr = function () {
       return;
     }
 
-    // 获取请求头信息
-    const requestHeadersSnapshot = { ...requestHeaders };
+    // 加密后的请求数据(加密模式下保存的加密数据)
+    let encryptedData: any;
 
     // 优先使用请求头自带的模式
-    if (requestHeadersSnapshot[securityHeaderKey]) {
-      finallyMode = requestHeadersSnapshot[securityHeaderKey];
+    if (requestHeaders[securityHeaderKey]) {
+      finallyMode = requestHeaders[securityHeaderKey];
     }
 
-    // 签名并添加额外的参数
-    originalSetRequestHeader.call(this, securityHeaderKey, finallyMode);
-    originalSetRequestHeader.call(
-      this,
-      signValueKeyName,
-      createHttpSignStr(
+    // 请求头上添加安全模式标识
+    this.setRequestHeader(securityHeaderKey, finallyMode);
+
+    // 请求头上添加debug标识
+    if (debugId) {
+      this.setRequestHeader(reqIdKey, debugId);
+    }
+
+    if (checkIsSignMode(finallyMode)) {
+      // 签名并添加额外的参数
+      originalSetRequestHeader.call(
+        this,
+        signValueKeyName,
+        createHttpSignStr(
+          xhrUrl,
+          { method: xhrMethod, headers: requestHeaders, body: data },
+          finallyMode,
+        ),
+      );
+    } else if (checkIsEncryption(finallyMode)) {
+      // 加密处理
+      const [encryptedUrl, encryptedOpts] = encryptedRequestParams(
         xhrUrl,
-        { method: xhrMethod, headers: requestHeadersSnapshot, body: data },
+        { headers: requestHeaders, body: data },
         finallyMode,
-      ),
-    );
+        'xhr',
+      );
+      // 如果url参数加密了，则重新open一个新地址
+      if (encryptedUrl !== xhrUrl) {
+        originalOpen.call(
+          this,
+          xhrMethod,
+          encryptedUrl,
+          typeof openOptions.async === 'undefined' ? true : openOptions.async,
+          openOptions.user,
+          openOptions.password,
+        );
+        // 重新设置header上的字段
+        Object.keys(requestHeaders).forEach((key) => {
+          originalSetRequestHeader.call(this, key, requestHeaders[key]);
+        });
+      }
+      encryptedData = encryptedOpts.body;
+    }
 
-    // 修改请求 URL
-    //  originXhr.open(originXhr.method, url, originXhr.async, originXhr.username, originXhr.password);
+    // 记录请求debug信息
+    if (debugId) {
+      debug?.store(debugId, 'modeRequest', finallyMode);
+      debug?.store(debugId, 'url', xhrUrl);
+      debug?.store(debugId, 'param', data);
+    }
 
     // 调用原始的 send 方法
-    originalSend.call(this, data);
+    originalSend.call(this, encryptedData || data);
+  };
+
+  // 劫持: 获取response内容，响应解密处理
+  const stashResponse: Record<string, any> = {};
+  let onreadystatechange: Function;
+  const getEncryptionResponseContent = (
+    _xhr: XMLHttpRequest,
+    key: 'response' | 'responseText' | 'responseXML',
+    securityType: any,
+  ) => {
+    if (typeof stashResponse[key] === 'string') {
+      return decryptedStr(stashResponse[key], securityType);
+    }
+    return stashResponse[key];
   };
+  instanceXhr.onreadystatechange = function () {
+    if (instanceXhr.readyState === 4) {
+      // getResponseHeader方法标头名称的搜索不区分大小写
+      const securityType = instanceXhr.getResponseHeader(securityHeaderKey);
+      // 如果是需要解密，则劫持response
+      if (securityType && checkIsEncryption(securityType)) {
+        // 记录原Response内容
+        stashResponse.response = instanceXhr.response;
+        stashResponse.responseText = instanceXhr.responseText;
+        stashResponse.responseXML = instanceXhr.responseXML;
 
-  return originXhr;
+        // 记录响应debug信息
+        if (debugId && debug) {
+          const content = getEncryptionResponseContent(
+            instanceXhr,
+            'response',
+            securityType,
+          );
+          let finallyResponse: any;
+          try {
+            finallyResponse = JSON.parse(content);
+          } catch (e) {
+            finallyResponse = content;
+          }
+          debug.store(debugId, 'modeResponse', securityType);
+          debug.store(debugId, 'response', finallyResponse);
+        }
+        // 劫持Response getter进行解密
+        Object.defineProperties(instanceXhr, {
+          response: {
+            get() {
+              return getEncryptionResponseContent(
+                this,
+                'response',
+                securityType,
+              );
+            },
+            configurable: true,
+            enumerable: false,
+          },
+          responseText: {
+            get() {
+              return getEncryptionResponseContent(
+                this,
+                'responseText',
+                securityType,
+              );
+            },
+            configurable: true,
+            enumerable: false,
+          },
+          responseXML: {
+            get() {
+              return getEncryptionResponseContent(
+                this,
+                'responseXML',
+                securityType,
+              );
+            },
+            configurable: true,
+            enumerable: false,
+          },
+        });
+      }
+    }
+    if (typeof onreadystatechange === 'function') {
+      onreadystatechange.call(this);
+    }
+  };
+
+  Object.defineProperties(instanceXhr, {
+    onreadystatechange: {
+      set(value) {
+        onreadystatechange = value;
+      },
+      configurable: true,
+      enumerable: false,
+    },
+  });
+
+  // 处理完毕，返回xhr实例
+  return instanceXhr;
 };
 
+// 标记劫持的XMLHttpRequest
+xhr.isLxSecurity = true;
+
 export const conflict = () => {
-  (window as any).XMLHttpRequest = xhr;
+  commonGlobal.XMLHttpRequest = xhr;
 };
 export const noConflict = () => {
-  (window as any).XMLHttpRequest = originRequester;
+  commonGlobal.XMLHttpRequest = OriginRequester;
 };
 
 export default xhr;