q-koa 13.8.29 → 13.8.31

package/core/app.js

@@ -143,22 +143,36 @@ class APP {
     // }));
     const { is_off = false } = this.config.restc
     if (!is_off) {
-      this.app.use((ctx, next) => {
-        const { url } = ctx.request
-        const appName = url.split('/')[1]
-        const excludes = [
-          ...this.config.restc.excludes,
-          ..._.get(ctx.app[appName], 'appConfig.restc.excludes', []).map(
-            (item) => `/${appName}/${item}`
-          ),
-        ]
-        this.app.use(
-          restc.koa2({
-            excludes,
-          })
-        )
-        return next()
-      })
+      /**
+       *  restc中间件
+       *  注意：这里只构建不注册。实例按 appName 惰性创建并缓存（app 数量有限），
+       *  避免在中间件内部调用 app.use() 导致 middleware 数组每个请求增长一个实例。
+       *  实际注册在 initApp() 中路由注册之后，保持"兜底生效"的原有顺序。
+       */
+      const globalExcludes = [...this.config.restc.excludes]
+      // 兜底实例：无法识别 appName 时使用原始全局 excludes（不含 appName 前缀）
+      const fallbackRestc = restc.koa2({ excludes: globalExcludes })
+      const restcCache = new Map()
+      this.restcMiddleware = async (ctx, next) => {
+        const appName = ctx.request.url.split('/')[1]
+        const app = this.app[appName]
+        // 未注册应用统一走兜底实例，保证缓存有界（避免随机 appName 撑爆内存）
+        if (!app || !app.appConfig) {
+          return await fallbackRestc(ctx, next)
+        }
+        if (!restcCache.has(appName)) {
+          const excludes = [
+            // 全局 excludes 也必须拼 /${appName}/ 前缀，
+            // 否则 Gateway.test 做 indexOf(rule) === 0 前缀匹配时永远不命中
+            ...globalExcludes.map((item) => `/${appName}/${item}`),
+            ..._.get(app, 'appConfig.restc.excludes', []).map(
+              (item) => `/${appName}/${item}`
+            ),
+          ]
+          restcCache.set(appName, restc.koa2({ excludes }))
+        }
+        return await restcCache.get(appName)(ctx, next)
+      }
     }
 
     /**
@@ -614,6 +628,11 @@ class APP {
     })
     this.app.use(router.routes()).use(router.allowedMethods())
 
+    // restc 排在路由之后注册：仅当没有其他中间件响应时才兜底生效（保持原有行为）
+    if (this.restcMiddleware) {
+      this.app.use(this.restcMiddleware)
+    }
+
     spinner.stop()
 
     console.log(chalk.green('==================== end ===================='))

package/core/file/plugins/weixin/controller.js

@@ -24,6 +24,64 @@ const { getCachedLoginData } = require('../../utils')
 
 const AllinPay = require('../../services/allinpay')
 
+/**
+ * 微信支付 V2 回调验签（MD5 / HMAC-SHA256）
+ * @param {Object} xmlObj  解析后的 xmlBody.xml 字段
+ * @param {string} partner_key  商户 API 密钥（32 位）
+ * @returns {boolean}
+ */
+const validateWxPayV2Sign = (xmlObj, partner_key) => {
+  if (!xmlObj || !xmlObj.sign) return false
+  const signType = (xmlObj.sign_type || 'MD5').toUpperCase()
+  const params = { ...xmlObj }
+  delete params.sign
+  // 按微信规则：过滤空值/undefined/key；ASCII 字典序；k=v&k=v&key=partner_key
+  const querystring =
+    Object.keys(params)
+      .filter(
+        (k) =>
+          params[k] !== undefined &&
+          params[k] !== '' &&
+          k !== 'key' &&
+          k !== 'pfx' &&
+          k !== 'partner_key'
+      )
+      .sort()
+      .map((k) => `${k}=${params[k]}`)
+      .join('&') + `&key=${partner_key}`
+  let expected
+  if (signType === 'HMAC-SHA256') {
+    expected = crypto
+      .createHmac('sha256', partner_key)
+      .update(querystring, 'utf8')
+      .digest('hex')
+      .toUpperCase()
+  } else {
+    expected = crypto
+      .createHash('md5')
+      .update(querystring, 'utf8')
+      .digest('hex')
+      .toUpperCase()
+  }
+  return expected === String(xmlObj.sign).toUpperCase()
+}
+
+/**
+ * 发送微信 V2 标准的 FAIL XML 响应（供回调异常/验签失败使用）
+ */
+const sendWxFail = (ctx, msg = 'FAIL') => {
+  ctx.status = 200
+  ctx.res.setHeader('Content-Type', 'application/xml')
+  ctx.res.end(
+    jsonToXml({
+      xml: {
+        return_code: 'FAIL',
+        return_msg: msg,
+      },
+    })
+  )
+}
+
 const check = ({ timestamp, nonce, signature, token }) => {
   const tmp = [token, timestamp, nonce].sort().join('')
   const currSign = crypto.createHash('sha1').update(tmp).digest('hex')
@@ -1490,6 +1548,49 @@ exports.union_notify = async (ctx) => {
 exports.notify = async (ctx) => {
   const { app } = getAppByCtx(ctx)
   const result = ctx.request.xmlBody
+  if (!result || !result.xml) return sendWxFail(ctx, 'INVALID_BODY')
+
+  // ===== 微信 V2 回调验签 + mch_id 匹配 =====
+  // 未识别到 xml.sign / return_code 时一律拒绝，防止未签名/异常报文进入业务
+  if (result.xml.return_code === 'SUCCESS' && !result.xml.sign) {
+    return sendWxFail(ctx, 'SIGN_MISSING')
+  }
+  const appConfig = getConfig(app)
+  const pay_config = 'weixin_pay'
+  const {
+    key,
+    partner_key,
+    mch_id: cfg_mch_id,
+    mchId,
+  } = await appConfig.getObject(pay_config)
+  const app_key = key && key.length > 10 ? key : partner_key
+  if (!validateWxPayV2Sign(result.xml, app_key)) {
+    app.service.log.push({
+      app,
+      message: `微信支付回调验签失败: ${JSON.stringify(result.xml)}`,
+    })
+    return sendWxFail(ctx, 'SIGN_ERROR')
+  }
+  // 商户号绑定校验：防止 A 商户的回调被伪装成 B 商户
+  const boundMchId = cfg_mch_id || mchId
+  if (boundMchId && result.xml.mch_id && boundMchId !== result.xml.mch_id) {
+    app.service.log.push({
+      app,
+      message: `微信支付回调商户号不匹配: cfg=${boundMchId} got=${result.xml.mch_id}`,
+    })
+    return sendWxFail(ctx, 'MCH_MISMATCH')
+  }
+  // return_code !== SUCCESS 一般是微信端通知失败/上游异常，不处理业务但仍应答 SUCCESS 让微信不再重放
+  if (result.xml.return_code !== 'SUCCESS') {
+    ctx.status = 200
+    ctx.res.setHeader('Content-Type', 'application/xml')
+    ctx.res.end(
+      jsonToXml({
+        xml: { return_code: 'SUCCESS' },
+      })
+    )
+    return
+  }
 
   let prefix = ''
   let order_id = result.xml.out_trade_no.split('_')[1]
@@ -1510,7 +1611,6 @@ exports.notify = async (ctx) => {
     transactionid = result.xml.transaction_id
   } catch (e) {}
 
-  // console.log(order_id, '微信支付回调-----', model, order_price, transactionid)
   if (app.service[model] && app.service[model].notify) {
     await app.service[model].notify({
       ctx,
@@ -1722,15 +1822,52 @@ const getRefundResultJson = async ({ req_info, app_key }) => {
 exports.refund_notify = async (ctx) => {
   const { app } = getAppByCtx(ctx)
   const result = ctx.request.xmlBody
-  const pay_config = ctx.params.sub || 'weixin_pay'
+  if (!result || !result.xml) return sendWxFail(ctx, 'INVALID_BODY')
 
+  const pay_config = ctx.params.sub || 'weixin_pay'
   const appConfig = getConfig(app)
-  const { key, partner_key } = await appConfig.getObject(pay_config)
+  const {
+    key,
+    partner_key,
+    mch_id: cfg_mch_id,
+    mchId,
+  } = await appConfig.getObject(pay_config)
+  const app_key = key && key.length > 10 ? key : partner_key
+
+  // ===== 退款回调外层 XML 先验签（req_info 是加密块，但外层 XML 必须签名防伪造） =====
+  if (result.xml.return_code === 'SUCCESS' && !result.xml.sign) {
+    return sendWxFail(ctx, 'SIGN_MISSING')
+  }
+  if (!validateWxPayV2Sign(result.xml, app_key)) {
+    app.service.log.push({
+      app,
+      message: `微信退款回调验签失败: ${JSON.stringify(result.xml)}`,
+    })
+    return sendWxFail(ctx, 'SIGN_ERROR')
+  }
+  const boundMchId = cfg_mch_id || mchId
+  if (boundMchId && result.xml.mch_id && boundMchId !== result.xml.mch_id) {
+    app.service.log.push({
+      app,
+      message: `微信退款回调商户号不匹配: cfg=${boundMchId} got=${result.xml.mch_id}`,
+    })
+    return sendWxFail(ctx, 'MCH_MISMATCH')
+  }
+  if (result.xml.return_code !== 'SUCCESS') {
+    ctx.status = 200
+    ctx.res.setHeader('Content-Type', 'application/xml')
+    ctx.res.end(
+      jsonToXml({
+        xml: { return_code: 'SUCCESS' },
+      })
+    )
+    return
+  }
 
   const { req_info } = result.xml
   const refundResult = await getRefundResultJson({
     req_info,
-    app_key: key.length > 10 ? key : partner_key,
+    app_key,
   })
 
   const {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.29",
+  "version": "13.8.31",
   "description": "",
   "main": "index.js",
   "scripts": {