@tmsfe/tms-core 0.0.158 → 0.0.160

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tmsfe/tms-core",
-  "version": "0.0.158",
+  "version": "0.0.160",
   "description": "tms运行时框架",
   "repository": {
     "type": "git",

package/src/encrypt/encrypt-util.ts

@@ -3,6 +3,7 @@
  * 暴露出来的工具函数封装原则：不可以向外throw错误，返回执行结果统一格式：{ success: boolean, msg: string, res: any }
  * https://iwiki.woa.com/p/4013041987#1.-RSA+AES-%E5%88%87%E6%8D%A2-Curve25519+XSalsa20%EF%BC%9A
  */
+import md5 from './md5';
 /* eslint-disable @typescript-eslint/no-require-imports */
 const ecc = require('./nacl.min.js');
 const base64Util = require('./nacl-util.min.js');
@@ -106,12 +107,10 @@ const eccUtil = {
           method: 'POST',
           data,
           enableHttp2: true,
-          success: (res) => {
-            const success = eccUtil._updateGlobalPublicKeyInfo(false, res.header);
-            resolve(success);
+          success: () => {
+            resolve(true);
           },
           fail: () => {
-            eccUtil._updateGlobalPublicKeyInfo(true);
             resolve(false);
           },
         });
@@ -135,10 +134,10 @@ const eccUtil = {
     return new baseUtil.BaseRespFac(success);
   },
   _privateKeyInfo: null,
-  getPrivateKeyInfo: (): CryptoKeyInfo => {
+  getPrivateKeyInfo: (forceUpdate = false): CryptoKeyInfo => {
     if (!wx.$_publicKey) return null;
     const serverPubInfo = wx.$_publicKey;
-    if (!eccUtil._privateKeyInfo || eccUtil._privateKeyInfo.serverPubId !== serverPubInfo.pubId) {
+    if (forceUpdate || !eccUtil._privateKeyInfo || eccUtil._privateKeyInfo.serverPubId !== serverPubInfo.pubId) {
       const keyPair = ecc.box.keyPair();  // 生成客户端公钥私钥
       eccUtil._privateKeyInfo = {
         serverPubId: serverPubInfo.pubId,                       // 服务端公钥id
@@ -156,27 +155,83 @@ const eccUtil = {
     switch (code) {
       case 0:
         return { retry: false, success: true };
-      case 11300:  // 解密失败
-        return { retry: false, success: false };
-      case 11305:  // 公钥id无效
+      case 11305:    // 公钥id无效
       case 11306:  { // 公钥过期
-        const genPubSuccess = await eccUtil._refreshPubKeyInfo(true); // 1. 获取公钥
-        if (!genPubSuccess) return { retry: false, success: false };
-        eccUtil.getPrivateKeyInfo();                                  // 2. 生成私钥
+        // 1. 获取公钥
+        eccUtil._refreshPubKeyInfo(true).then((genPubSuccess) => {
+          genPubSuccess && eccUtil.getPrivateKeyInfo();   // 2. 生成私钥
+        });
         return { retry: true, success: false };
       }
-      case 11307:  // 加密未开启
-        return { retry: false, success: false };
+      case 11308:  { // 密钥对有问题
+        eccUtil.getPrivateKeyInfo(true);                   // 重新生成私钥
+        return { retry: true, success: false };
+      }
+      case 11300:  // 解密失败
       case 11301:
       case 11302:
       case 11303:
       case 11304:
-      case 11308:
+      case 11307:  // 加密未开启
+        return { retry: true, success: false };
+      case 11309:
         return { retry: false, success: false };
       default:     // 其他网关错误码
         return { retry: false, success: true };
     }
   },
+  _getSignSharedByte: () => baseUtil.decUrl('mEufQpM1n5J8-OZZoJE7ucYMC2suTjfsHUq_6z5cyh8'),
+  // 计算客户端加密签名
+  getClientCryptoSign: (data = {}, header = {}, sharedByte): string => {
+    const obj = baseUtil.formatHeader(Object.assign({}, data, header));
+    // 1. 生成签名前的字符串
+    const str = Object.keys(obj).filter(item => obj[item])
+      .sort()
+      .reduce((pre, cur) => {
+        pre.push(`${cur}=${obj[cur]}`);
+        return pre;
+      }, [])
+      .join('&');
+    // 2. md5
+    const md5Str = md5(str);
+    const nonce = ecc.randomBytes(ecc.box.nonceLength);
+    const encrypted = ecc.box.after(md5Str, nonce, sharedByte);
+    const combined = new Uint8Array(nonce.length + encrypted.length);
+    combined.set(nonce);
+    combined.set(encrypted, nonce.length);
+    return baseUtil.encUrl(combined);
+  },
+  // 验证服务端加密签名
+  verifyServerCryptoSign: (traceId: string, resHeader = {}): boolean => {
+    const formatHeader = baseUtil.formatHeader(resHeader);
+    const signStr = formatHeader['x-crypto-sign'];
+    const obj = {
+      'x-encrypt-key': formatHeader['x-encrypt-key'],
+      'x-encrypt-response': formatHeader['x-encrypt-response'],
+      'x-response-header-name': formatHeader['x-response-header-name'],
+      'x-encrypted-headers': formatHeader['x-encrypted-headers'],
+      'x-crypto-enable': formatHeader['x-crypto-enable'],
+      'content-type': formatHeader['content-type'],
+      'x-gateway-code': formatHeader['x-gateway-code'],
+      'x-crypto-pub-id': formatHeader['x-crypto-pub-id'],
+      'x-crypto-pub-key': formatHeader['x-crypto-pub-key'],
+      'x-crypto-pub-exp': formatHeader['x-crypto-pub-exp'],
+      'x-crypto-path': formatHeader['x-crypto-path'],
+      'x-trace-id': traceId,
+    };
+    const msg = baseUtil.decUrl(signStr);
+    const decrypted = ecc.sign.open(msg, eccUtil._getSignSharedByte());
+    const str = Object.keys(obj).filter(item => obj[item])
+      .sort()
+      .reduce((pre, cur) => {
+        pre.push(`${cur}=${obj[cur]}`);
+        return pre;
+      }, [])
+      .join('&');
+    const preHashArr = md5(str);
+    const verified = preHashArr.length === decrypted.length && preHashArr.every((v, i) => v === decrypted[i]);
+    return verified;
+  },
   /* eslint-enable complexity */
   execEncrypt: (input: string, ignoreNull = false): BaseResp<{
     cryptoKeyInfo: CryptoKeyInfo,
@@ -357,23 +412,30 @@ const reqEncrypt = (method: string, data: any, header: {
   if (!success) {
     return new baseUtil.BaseRespFac(null, false, `请求Header加密失败: ${msg}`);
   }
+  const cryptoHeader = {
+    'X-Crypto-Mode': '2',  // ecc加密模式
+    'X-Encrypted-Headers': res.encryptedContent,
+    'X-Encrypt-Pub': res.cryptoKeyInfo.serverPubId,
+    'X-Encrypt-Key': res.cryptoKeyInfo.clientPublicKey,
+    'X-Encrypt-Response': '3',                 // 加密，二进制
+    'X-Response-Header-Name': encryptedResponseHeaderName,
+    'Content-Type': 'text/plain',
+  };
+  const cryptoSign = eccUtil.getClientCryptoSign(baseUtil._isObject(finalData) ? finalData : {
+    body: finalData,
+  }, cryptoHeader, res.cryptoKeyInfo.sharedByte);
   return new baseUtil.BaseRespFac({
     cryptoKeyInfo: res.cryptoKeyInfo,
     data: finalData,
     header: {
-      'Content-Type': 'text/plain',
-      'X-Crypto-Mode': '2',                       // ecc加密模式
-      'X-Encrypted-Headers': res.encryptedContent,
-      'X-Encrypt-Pub': res.cryptoKeyInfo.serverPubId,
-      'X-Encrypt-Key': res.cryptoKeyInfo.clientPublicKey,
-      'X-Encrypt-Response': '3',                 // 加密，二进制
-      'X-Response-Header-Name': encryptedResponseHeaderName,
+      ...cryptoHeader,
+      'X-Crypto-Sign': cryptoSign,
     },
   });
 };
 // 解密请求结果
-const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<BaseResp<{
-  retry: boolean,
+const resDecrypt = async (requestTraceId: string, header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<BaseResp<{
+  retry: boolean,  // 是否需要明文重试
   header: any,
   data: any,
 }>> => {
@@ -397,13 +459,19 @@ const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<B
     }
     const { retry, success: gwSuccess } = await eccUtil.resolveGwCode(gatewayCode);
     if (!gwSuccess) {
+      // 网关加密流程出现问题，需要验证网关签名
+      const verified = eccUtil.verifyServerCryptoSign(requestTraceId, header);
+      if (!verified) {
+        // 验证失败，表示请求被篡改
+        return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, '响应被篡改');
+      }
       return new baseUtil.BaseRespFac({ header: null, data: null, retry }, false, `网关返回错误码: ${gatewayCode}`);
     }
     let decryptedHeaders = {};
     if (encryptedResponseHeaderName) {                         // 解密响应Header
       const { success, msg, res } = eccUtil.execDecrypt(baseUtil.decUrl(encryptedHeaders), cryptoKeyInfo);
       if (!success) {
-        return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, `解密响应Header失败: ${msg}`);
+        return new baseUtil.BaseRespFac({ header: null, data: null, retry: true }, false, `解密响应Header失败: ${msg}`);
       }
       decryptedHeaders = JSON.parse(res);
     }
@@ -411,7 +479,7 @@ const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<B
     const cipher = needDecode ? baseUtil.decUrl(data) : new Uint8Array(data);
     const { success, msg, res } = eccUtil.execDecrypt(cipher, cryptoKeyInfo);
     if (!success) {
-      return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, `解密响应Body失败: ${msg}`);
+      return new baseUtil.BaseRespFac({ header: null, data: null, retry: true }, false, `解密响应Body失败: ${msg}`);
     }
     const decryptedBody = JSON.parse(res); // 解密响应Body
     return new baseUtil.BaseRespFac({
@@ -424,24 +492,40 @@ const resDecrypt = async (header, data, cryptoKeyInfo: CryptoKeyInfo): Promise<B
     });
   } catch (e) {
     // 因为上面的逻辑有parse, 所以这里再加一个catch
-    return new baseUtil.BaseRespFac({ header: null, data: null, retry: false }, false, `解密响应Body失败: ${JSON.stringify(e)}`);
+    return new baseUtil.BaseRespFac({ header: null, data: null, retry: true }, false, `解密响应Body失败: ${JSON.stringify(e)}`);
   }
 };
 // 处理接下来的请求开关
 let dealEncryptionSwitching = false;
-const dealEncryptionSwitch = async (path: string, resHeader): Promise<void> => {
+const dealEncryptionSwitch = async (path: string, traceId: string, resHeader): Promise<boolean> => {
   if ((!resHeader || dealEncryptionSwitching)) {
     return;
   }
   dealEncryptionSwitching = true;
   const formatHeader = baseUtil.formatHeader(resHeader);
   if (formatHeader['x-crypto-enable'] === '0') {
-    eccUtil.closeCrypto();
+    // 网关加密验签，验签通过才能执行关闭
+    const verified = eccUtil.verifyServerCryptoSign(traceId, formatHeader);
+    if (verified) {
+      eccUtil.closeCrypto();
+    }
   } else if (formatHeader['x-crypto-enable'] === '1') {
-    `${baseUtil.getSinanHost()}/user/login` === path && eccUtil._updateGlobalPublicKeyInfo(false, formatHeader);
+    if ([
+      `${baseUtil.getSinanHost()}/user/login`,
+      `${baseUtil.getSinanHost()}/basic/crypto/lastkey`,
+    ].indexOf(path) > -1) {
+      const verified = eccUtil.verifyServerCryptoSign(traceId, formatHeader);
+      if (!verified) {
+        // 验签失败，表示请求被篡改
+        dealEncryptionSwitching = false;
+        return false;
+      }
+      eccUtil._updateGlobalPublicKeyInfo(false, formatHeader);
+    }
     await eccUtil.openCrypto();
   } // 0是关闭，1是开启, 2是保持
   dealEncryptionSwitching = false;
+  return true;
 };
 
 const encryptUtil = {

package/src/encrypt/index.ts

@@ -71,6 +71,7 @@ function proxyWxRequest(): void {
     value(options: any) {
       const { url, method, data, header = {}, success, fail, complete, dataType, responseType } = options;
       const traceparent = genTraceparent();
+      const traceId = traceparent.split('-')[1];
       const originalOptions = { ...options };
 
       // 如果用户自定义了dataType或者responseType，则不做处理
@@ -79,7 +80,7 @@ function proxyWxRequest(): void {
         originalRequestApi.call(this, {
           ...originalOptions,
           success: (res) => {
-            encryptUtil.dealEncryptionSwitch(url, res.header);
+            encryptUtil.dealEncryptionSwitch(url, traceId, res.header);
             success?.call(this, res);
           },
           header: { ...header, Traceparent: traceparent },
@@ -94,9 +95,14 @@ function proxyWxRequest(): void {
         util.logInfo(url, traceparent, msg);
         originalRequestApi.call(this, {
           ...originalOptions,
-          success: (res) => {
-            encryptUtil.dealEncryptionSwitch(url, res.header);
-            success?.call(this, res);
+          success: async (res) => {
+            const dealSuccess = await encryptUtil.dealEncryptionSwitch(url, traceId, res.header);
+            if (dealSuccess) {
+              success?.call(this, res);
+            } else {
+              util.reportFunc(url, traceparent, `加密验签不通过: ${JSON.stringify(res)}`);
+              fail?.call(this, new Error('加密验签不通过'));
+            }
           },
           header: { ...header, Traceparent: traceparent },
         });
@@ -115,26 +121,34 @@ function proxyWxRequest(): void {
         responseType: 'arraybuffer',
         success: async (result) => {
           const { header: resHeader, data: resData } = result;
-          const { success: resSuccess, msg, res } = await encryptUtil.resDecrypt(resHeader, resData, cryptoKeyInfo);
-          if (resSuccess) {
-            util.logInfo(url, traceparent, '解密成功');
-            encryptUtil.dealEncryptionSwitch(url, resHeader);
-            success?.call(this, res);
-            const completeRes: any = await completePromp;
-            completeRes.header = resHeader;
-            completeRes.data = resData;
-            complete?.call(this, completeRes);
-          } else {
+          const { success: decSuccess, msg, res } = await encryptUtil
+            .resDecrypt(traceId, resHeader, resData, cryptoKeyInfo);
+          if (res.retry) { // 解密出现问题，需要明文重试
             util.reportFunc(url, traceparent, `解密失败：${msg}`);
+            const newTraceparent = genTraceparent();
+            const traceId = newTraceparent.split('-')[1];
             originalRequestApi.call(this, {
               ...originalOptions,
               success: (res) => {
-                encryptUtil.dealEncryptionSwitch(url, res.header);
+                encryptUtil.dealEncryptionSwitch(url, traceId, res.header);
                 success?.call(this, res);
               },
-              header: { ...header, Traceparent: genTraceparent() },
+              header: { ...header, Traceparent: newTraceparent },
             });
+            return;
+          }
+          if (decSuccess) {
+            util.logInfo(url, traceparent, '解密成功');
+            encryptUtil.dealEncryptionSwitch(url, traceId, resHeader);
+            success?.call(this, res);
+          } else { // 不支持明文重试，且解密失败
+            util.reportFunc(url, traceparent, `解密失败：${msg}`);
+            fail?.call(this, new Error(msg));
           }
+          const completeRes: any = await completePromp;
+          completeRes.header = resHeader;
+          completeRes.data = resData;
+          complete?.call(this, completeRes);
         },
         fail: async (err) => {
           fail?.call(this, err);

package/src/encrypt/md5.js

@@ -0,0 +1 @@
+function safeAdd(x,y){const lsw=(x&0xffff)+(y&0xffff);const msw=(x>>16)+(y>>16)+(lsw>>16);return(msw<<16)|(lsw&0xffff)}function bitRotateLeft(num,cnt){return(num<<cnt)|(num>>>(32-cnt))}function md5cmn(q,a,b,x,s,t){return safeAdd(bitRotateLeft(safeAdd(safeAdd(a,q),safeAdd(x,t)),s),b)}function md5ff(a,b,c,d,x,s,t){return md5cmn((b&c)|(~b&d),a,b,x,s,t)}function md5gg(a,b,c,d,x,s,t){return md5cmn((b&d)|(c&~d),a,b,x,s,t)}function md5hh(a,b,c,d,x,s,t){return md5cmn(b^c^d,a,b,x,s,t)}function md5ii(a,b,c,d,x,s,t){return md5cmn(c^(b|~d),a,b,x,s,t)}function binlMD5(x,len){x[len>>5]|=0x80<<len%32;x[(((len+64)>>>9)<<4)+14]=len;let a=1732584193;let b=-271733879;let c=-1732584194;let d=271733878;for(let i=0;i<x.length;i+=16){const olda=a;const oldb=b;const oldc=c;const oldd=d;a=md5ff(a,b,c,d,x[i],7,-680876936);d=md5ff(d,a,b,c,x[i+1],12,-389564586);c=md5ff(c,d,a,b,x[i+2],17,606105819);b=md5ff(b,c,d,a,x[i+3],22,-1044525330);a=md5ff(a,b,c,d,x[i+4],7,-176418897);d=md5ff(d,a,b,c,x[i+5],12,1200080426);c=md5ff(c,d,a,b,x[i+6],17,-1473231341);b=md5ff(b,c,d,a,x[i+7],22,-45705983);a=md5ff(a,b,c,d,x[i+8],7,1770035416);d=md5ff(d,a,b,c,x[i+9],12,-1958414417);c=md5ff(c,d,a,b,x[i+10],17,-42063);b=md5ff(b,c,d,a,x[i+11],22,-1990404162);a=md5ff(a,b,c,d,x[i+12],7,1804603682);d=md5ff(d,a,b,c,x[i+13],12,-40341101);c=md5ff(c,d,a,b,x[i+14],17,-1502002290);b=md5ff(b,c,d,a,x[i+15],22,1236535329);a=md5gg(a,b,c,d,x[i+1],5,-165796510);d=md5gg(d,a,b,c,x[i+6],9,-1069501632);c=md5gg(c,d,a,b,x[i+11],14,643717713);b=md5gg(b,c,d,a,x[i],20,-373897302);a=md5gg(a,b,c,d,x[i+5],5,-701558691);d=md5gg(d,a,b,c,x[i+10],9,38016083);c=md5gg(c,d,a,b,x[i+15],14,-660478335);b=md5gg(b,c,d,a,x[i+4],20,-405537848);a=md5gg(a,b,c,d,x[i+9],5,568446438);d=md5gg(d,a,b,c,x[i+14],9,-1019803690);c=md5gg(c,d,a,b,x[i+3],14,-187363961);b=md5gg(b,c,d,a,x[i+8],20,1163531501);a=md5gg(a,b,c,d,x[i+13],5,-1444681467);d=md5gg(d,a,b,c,x[i+2],9,-51403784);c=md5gg(c,d,a,b,x[i+7],14,1735328473);b=md5gg(b,c,d,a,x[i+12],20,-1926607734);a=md5hh(a,b,c,d,x[i+5],4,-378558);d=md5hh(d,a,b,c,x[i+8],11,-2022574463);c=md5hh(c,d,a,b,x[i+11],16,1839030562);b=md5hh(b,c,d,a,x[i+14],23,-35309556);a=md5hh(a,b,c,d,x[i+1],4,-1530992060);d=md5hh(d,a,b,c,x[i+4],11,1272893353);c=md5hh(c,d,a,b,x[i+7],16,-155497632);b=md5hh(b,c,d,a,x[i+10],23,-1094730640);a=md5hh(a,b,c,d,x[i+13],4,681279174);d=md5hh(d,a,b,c,x[i],11,-358537222);c=md5hh(c,d,a,b,x[i+3],16,-722521979);b=md5hh(b,c,d,a,x[i+6],23,76029189);a=md5hh(a,b,c,d,x[i+9],4,-640364487);d=md5hh(d,a,b,c,x[i+12],11,-421815835);c=md5hh(c,d,a,b,x[i+15],16,530742520);b=md5hh(b,c,d,a,x[i+2],23,-995338651);a=md5ii(a,b,c,d,x[i],6,-198630844);d=md5ii(d,a,b,c,x[i+7],10,1126891415);c=md5ii(c,d,a,b,x[i+14],15,-1416354905);b=md5ii(b,c,d,a,x[i+5],21,-57434055);a=md5ii(a,b,c,d,x[i+12],6,1700485571);d=md5ii(d,a,b,c,x[i+3],10,-1894986606);c=md5ii(c,d,a,b,x[i+10],15,-1051523);b=md5ii(b,c,d,a,x[i+1],21,-2054922799);a=md5ii(a,b,c,d,x[i+8],6,1873313359);d=md5ii(d,a,b,c,x[i+15],10,-30611744);c=md5ii(c,d,a,b,x[i+6],15,-1560198380);b=md5ii(b,c,d,a,x[i+13],21,1309151649);a=md5ii(a,b,c,d,x[i+4],6,-145523070);d=md5ii(d,a,b,c,x[i+11],10,-1120210379);c=md5ii(c,d,a,b,x[i+2],15,718787259);b=md5ii(b,c,d,a,x[i+9],21,-343485551);a=safeAdd(a,olda);b=safeAdd(b,oldb);c=safeAdd(c,oldc);d=safeAdd(d,oldd)}return[a,b,c,d]}function binl2rstr(input){let output='';const length32=input.length*32;for(let i=0;i<length32;i+=8){output+=String.fromCharCode((input[i>>5]>>>i%32)&0xff)}return output}function rstr2binl(input){const output=[];output[(input.length>>2)-1]=undefined;for(let i=0;i<output.length;i+=1){output[i]=0}const length8=input.length*8;for(let i=0;i<length8;i+=8){output[i>>5]|=(input.charCodeAt(i/8)&0xff)<<i%32}return output}function rstrMD5(s){return binl2rstr(binlMD5(rstr2binl(s),s.length*8))}function str2rstrUTF8(input){return unescape(encodeURIComponent(input))}function rawMD5(s){return rstrMD5(str2rstrUTF8(s))}function rstr2uint8array(input){const output=new Uint8Array(input.length);for(let i=0;i<input.length;i++){output[i]=input.charCodeAt(i)}return output}function md5(string){return rstr2uint8array(rawMD5(string))}export default md5;

package/src/md5.js

@@ -356,7 +356,7 @@ function hexHMACMD5(k, d) {
  *
  * @param {string} string Input string
  * @param {string} [key] HMAC key
- * @param {boolean} [raw] Raw output switch
+ * @param {string} [raw] Raw output switch
  * @returns {string} MD5 output
  */
 function md5(string, key, raw) {

package/src/navbarUtils.js

@@ -151,7 +151,7 @@ const getNavBarConfigData = () => { // eslint-disable-line require-jsdoc
     statusBarHeight = isIOS ? StatusBarHeightOnIOS : StatusBarHeightOnAndroid;
   }
 
-  const enable = compareVersion(version, '7.0.0') >= 0 || brand === 'devtools'; // 微信版本是否支持自定义顶栏，不支持时自动隐藏
+  const enable = compareVersion(version, '7.0.0') >= 0 || brand === 'devtools' || platform === 'ohos'; // 微信版本是否支持自定义顶栏，不支持时自动隐藏
   const enterOptions = getEnterOptions();
   if (enable) {
     return { enable, ...calculateNavBarLayout(isIOS, statusBarHeight, enterOptions.apiCategory) };