q-koa 13.8.34 → 13.8.36

package/core/file/plugins/weixin/controller.js

@@ -95,10 +95,8 @@ const validateUnionNotifySign = ({ notifyData, signType, publicKey, md5Key }) =>
   if (!notifyData || !notifyData.sign) return false
   const params = { ...notifyData }
   const sign = String(params.sign)
+  // 通联签名规则：仅剔除 sign 字段本身，signtype/signType 仍保留在原串里
   delete params.sign
-  // 通联回调报文字段是全小写 signtype；同时删除大小写两种做防御
-  delete params.signType
-  delete params.signtype
 
   // 通联 buildSignStr：按 ASCII 字典序拼接，跳过空/undefined/null
   const sortedKeys = Object.keys(params).sort()
@@ -123,7 +121,10 @@ const validateUnionNotifySign = ({ notifyData, signType, publicKey, md5Key }) =>
   // 默认 RSA-SHA1（与 allinpay.js verifySign 保持一致）
   if (!publicKey) return false
   try {
-    const pem = `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`
+    // 兼容两种配置格式：已经带 PEM 头尾的直接用；纯 base64 body 再包裹头尾
+    const pem = String(publicKey).includes('-----BEGIN')
+      ? String(publicKey)
+      : `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`
     const verify = crypto.createVerify('RSA-SHA1')
     verify.update(signStr, 'utf8')
     return verify.verify(pem, sign, 'base64')

package/core/file/services/allinpay.js

@@ -67,10 +67,16 @@ class AllinPay {
     const signStr = this.buildSignStr(params)
 
     if (this.signType === 'RSA') {
-      const privateKey = `-----BEGIN RSA PRIVATE KEY-----\n${this.privateKey}\n-----END RSA PRIVATE KEY-----`
+      // 兼容三种配置格式：已经带 PEM 头尾直接使用；否则默认包 PKCS#1 (BEGIN RSA PRIVATE KEY) 头尾
+      let pem
+      if (String(this.privateKey).includes('-----BEGIN')) {
+        pem = String(this.privateKey)
+      } else {
+        pem = `-----BEGIN RSA PRIVATE KEY-----\n${this.privateKey}\n-----END RSA PRIVATE KEY-----`
+      }
       const sign = crypto.createSign('RSA-SHA1')
       sign.update(signStr, 'utf8')
-      const signature = sign.sign(privateKey, 'base64')
+      const signature = sign.sign(pem, 'base64')
 
       // crypto.createHash('md5').update(originStr).digest('hex')
       return signature
@@ -93,10 +99,13 @@ class AllinPay {
 
     const signStr = this.buildSignStr(paramsCopy)
 
-    const publicKey = `-----BEGIN PUBLIC KEY-----\n${this.publicKey}\n-----END PUBLIC KEY-----`
+    // 兼容两种配置格式：已经带 PEM 头尾的直接用；纯 base64 body 再包裹头尾
+    const pem = String(this.publicKey).includes('-----BEGIN')
+      ? String(this.publicKey)
+      : `-----BEGIN PUBLIC KEY-----\n${this.publicKey}\n-----END PUBLIC KEY-----`
     const verify = crypto.createVerify('RSA-SHA1')
     verify.update(signStr, 'utf8')
-    const result = verify.verify(publicKey, sign, 'base64')
+    const result = verify.verify(pem, sign, 'base64')
 
     return result
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.34",
+  "version": "13.8.36",
   "description": "",
   "main": "index.js",
   "scripts": {