q-koa 13.8.30 → 13.8.31

package/core/file/plugins/weixin/controller.js

@@ -24,6 +24,64 @@ const { getCachedLoginData } = require('../../utils')
 
 const AllinPay = require('../../services/allinpay')
 
+/**
+ * 微信支付 V2 回调验签（MD5 / HMAC-SHA256）
+ * @param {Object} xmlObj  解析后的 xmlBody.xml 字段
+ * @param {string} partner_key  商户 API 密钥（32 位）
+ * @returns {boolean}
+ */
+const validateWxPayV2Sign = (xmlObj, partner_key) => {
+  if (!xmlObj || !xmlObj.sign) return false
+  const signType = (xmlObj.sign_type || 'MD5').toUpperCase()
+  const params = { ...xmlObj }
+  delete params.sign
+  // 按微信规则：过滤空值/undefined/key；ASCII 字典序；k=v&k=v&key=partner_key
+  const querystring =
+    Object.keys(params)
+      .filter(
+        (k) =>
+          params[k] !== undefined &&
+          params[k] !== '' &&
+          k !== 'key' &&
+          k !== 'pfx' &&
+          k !== 'partner_key'
+      )
+      .sort()
+      .map((k) => `${k}=${params[k]}`)
+      .join('&') + `&key=${partner_key}`
+  let expected
+  if (signType === 'HMAC-SHA256') {
+    expected = crypto
+      .createHmac('sha256', partner_key)
+      .update(querystring, 'utf8')
+      .digest('hex')
+      .toUpperCase()
+  } else {
+    expected = crypto
+      .createHash('md5')
+      .update(querystring, 'utf8')
+      .digest('hex')
+      .toUpperCase()
+  }
+  return expected === String(xmlObj.sign).toUpperCase()
+}
+
+/**
+ * 发送微信 V2 标准的 FAIL XML 响应（供回调异常/验签失败使用）
+ */
+const sendWxFail = (ctx, msg = 'FAIL') => {
+  ctx.status = 200
+  ctx.res.setHeader('Content-Type', 'application/xml')
+  ctx.res.end(
+    jsonToXml({
+      xml: {
+        return_code: 'FAIL',
+        return_msg: msg,
+      },
+    })
+  )
+}
+
 const check = ({ timestamp, nonce, signature, token }) => {
   const tmp = [token, timestamp, nonce].sort().join('')
   const currSign = crypto.createHash('sha1').update(tmp).digest('hex')
@@ -1490,6 +1548,49 @@ exports.union_notify = async (ctx) => {
 exports.notify = async (ctx) => {
   const { app } = getAppByCtx(ctx)
   const result = ctx.request.xmlBody
+  if (!result || !result.xml) return sendWxFail(ctx, 'INVALID_BODY')
+
+  // ===== 微信 V2 回调验签 + mch_id 匹配 =====
+  // 未识别到 xml.sign / return_code 时一律拒绝，防止未签名/异常报文进入业务
+  if (result.xml.return_code === 'SUCCESS' && !result.xml.sign) {
+    return sendWxFail(ctx, 'SIGN_MISSING')
+  }
+  const appConfig = getConfig(app)
+  const pay_config = 'weixin_pay'
+  const {
+    key,
+    partner_key,
+    mch_id: cfg_mch_id,
+    mchId,
+  } = await appConfig.getObject(pay_config)
+  const app_key = key && key.length > 10 ? key : partner_key
+  if (!validateWxPayV2Sign(result.xml, app_key)) {
+    app.service.log.push({
+      app,
+      message: `微信支付回调验签失败: ${JSON.stringify(result.xml)}`,
+    })
+    return sendWxFail(ctx, 'SIGN_ERROR')
+  }
+  // 商户号绑定校验：防止 A 商户的回调被伪装成 B 商户
+  const boundMchId = cfg_mch_id || mchId
+  if (boundMchId && result.xml.mch_id && boundMchId !== result.xml.mch_id) {
+    app.service.log.push({
+      app,
+      message: `微信支付回调商户号不匹配: cfg=${boundMchId} got=${result.xml.mch_id}`,
+    })
+    return sendWxFail(ctx, 'MCH_MISMATCH')
+  }
+  // return_code !== SUCCESS 一般是微信端通知失败/上游异常，不处理业务但仍应答 SUCCESS 让微信不再重放
+  if (result.xml.return_code !== 'SUCCESS') {
+    ctx.status = 200
+    ctx.res.setHeader('Content-Type', 'application/xml')
+    ctx.res.end(
+      jsonToXml({
+        xml: { return_code: 'SUCCESS' },
+      })
+    )
+    return
+  }
 
   let prefix = ''
   let order_id = result.xml.out_trade_no.split('_')[1]
@@ -1510,7 +1611,6 @@ exports.notify = async (ctx) => {
     transactionid = result.xml.transaction_id
   } catch (e) {}
 
-  // console.log(order_id, '微信支付回调-----', model, order_price, transactionid)
   if (app.service[model] && app.service[model].notify) {
     await app.service[model].notify({
       ctx,
@@ -1722,15 +1822,52 @@ const getRefundResultJson = async ({ req_info, app_key }) => {
 exports.refund_notify = async (ctx) => {
   const { app } = getAppByCtx(ctx)
   const result = ctx.request.xmlBody
-  const pay_config = ctx.params.sub || 'weixin_pay'
+  if (!result || !result.xml) return sendWxFail(ctx, 'INVALID_BODY')
 
+  const pay_config = ctx.params.sub || 'weixin_pay'
   const appConfig = getConfig(app)
-  const { key, partner_key } = await appConfig.getObject(pay_config)
+  const {
+    key,
+    partner_key,
+    mch_id: cfg_mch_id,
+    mchId,
+  } = await appConfig.getObject(pay_config)
+  const app_key = key && key.length > 10 ? key : partner_key
+
+  // ===== 退款回调外层 XML 先验签（req_info 是加密块，但外层 XML 必须签名防伪造） =====
+  if (result.xml.return_code === 'SUCCESS' && !result.xml.sign) {
+    return sendWxFail(ctx, 'SIGN_MISSING')
+  }
+  if (!validateWxPayV2Sign(result.xml, app_key)) {
+    app.service.log.push({
+      app,
+      message: `微信退款回调验签失败: ${JSON.stringify(result.xml)}`,
+    })
+    return sendWxFail(ctx, 'SIGN_ERROR')
+  }
+  const boundMchId = cfg_mch_id || mchId
+  if (boundMchId && result.xml.mch_id && boundMchId !== result.xml.mch_id) {
+    app.service.log.push({
+      app,
+      message: `微信退款回调商户号不匹配: cfg=${boundMchId} got=${result.xml.mch_id}`,
+    })
+    return sendWxFail(ctx, 'MCH_MISMATCH')
+  }
+  if (result.xml.return_code !== 'SUCCESS') {
+    ctx.status = 200
+    ctx.res.setHeader('Content-Type', 'application/xml')
+    ctx.res.end(
+      jsonToXml({
+        xml: { return_code: 'SUCCESS' },
+      })
+    )
+    return
+  }
 
   const { req_info } = result.xml
   const refundResult = await getRefundResultJson({
     req_info,
-    app_key: key.length > 10 ? key : partner_key,
+    app_key,
   })
 
   const {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.30",
+  "version": "13.8.31",
   "description": "",
   "main": "index.js",
   "scripts": {