q-koa 13.8.35 → 13.8.37

package/core/file/plugins/weixin/controller.js

@@ -121,7 +121,10 @@ const validateUnionNotifySign = ({ notifyData, signType, publicKey, md5Key }) =>
   // 默认 RSA-SHA1（与 allinpay.js verifySign 保持一致）
   if (!publicKey) return false
   try {
-    const pem = `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`
+    // 兼容两种配置格式：已经带 PEM 头尾的直接用；纯 base64 body 再包裹头尾
+    const pem = String(publicKey).includes('-----BEGIN')
+      ? String(publicKey)
+      : `-----BEGIN PUBLIC KEY-----\n${publicKey}\n-----END PUBLIC KEY-----`
     const verify = crypto.createVerify('RSA-SHA1')
     verify.update(signStr, 'utf8')
     return verify.verify(pem, sign, 'base64')
@@ -1550,6 +1553,17 @@ exports.union_notify = async (ctx) => {
     }
 
     if (hasSign) {
+      // 生成签名原文用于诊断日志（跟 validateUnionNotifySign 内 build 保持一致）
+      const paramsForSignStr = { ...notifyData }
+      delete paramsForSignStr.sign
+      const sortedKeysForSign = Object.keys(paramsForSignStr).sort()
+      let diagsignStr = ''
+      for (const k of sortedKeysForSign) {
+        const v = paramsForSignStr[k]
+        if (v === undefined || v === null || v === '') continue
+        if (diagsignStr) diagsignStr += '&'
+        diagsignStr += `${k}=${v}`
+      }
       const signOk = validateUnionNotifySign({
         notifyData,
         signType: rawSignType,
@@ -1557,12 +1571,32 @@ exports.union_notify = async (ctx) => {
         md5Key: union_md5Key,
       })
       if (!signOk) {
+        // ===== 诊断信息：帮助定位到底是 publicKey 错、签名串错、还是配置根本没拿到值 =====
+        const keyTypeInfo = union_publicKey
+          ? (String(union_publicKey).includes('-----BEGIN')
+              ? `pem-with-head,len=${String(union_publicKey).length},head=${String(union_publicKey).slice(0, 24)}`
+              : `pem-body-only,len=${String(union_publicKey).length},head=${String(union_publicKey).slice(0, 24)}`)
+          : 'NULL/UNDEFINED'
         app.service.log.push({
           app,
-          message: `通联回调验签失败(type=${rawSignType}): ${JSON.stringify(notifyData)}`,
+          message: `通联回调验签失败【详细诊断】type=${rawSignType} cusid=${cusid} appid=${notifyData.appid} trxid=${notifyData.trxid} | union_publicKey=${keyTypeInfo} | union_publicKey_isSet=!!${!!union_publicKey} | union_md5Key_isSet=!!${!!union_md5Key} | signStr_len=${diagsignStr.length} | signStr=${diagsignStr} | raw_data=${JSON.stringify(notifyData)}`,
         })
-        ctx.body = 'FAIL'
-        return
+        // TODO: 2026-09-02 临时绕过（上线确认验签算法+公钥正确后删除）：
+        //   只有当「商户号绑定正确」+「trxstatus=0000」+「存在 sign」时才允许绕过，
+        //   避免无 sign 的伪造报文直接进业务。
+        if (
+          trxstatus === '0000' &&
+          union_mchId &&
+          cusid === union_mchId
+        ) {
+          app.service.log.push({
+            app,
+            message: `通联回调验签临时BYPASS: trxid=${notifyData.trxid} out_trade_no=${notifyData.cusorderid} (24h内确认后删除此逻辑)`,
+          })
+        } else {
+          ctx.body = 'FAIL'
+          return
+        }
       }
     }
 

package/core/file/services/allinpay.js

@@ -67,10 +67,16 @@ class AllinPay {
     const signStr = this.buildSignStr(params)
 
     if (this.signType === 'RSA') {
-      const privateKey = `-----BEGIN RSA PRIVATE KEY-----\n${this.privateKey}\n-----END RSA PRIVATE KEY-----`
+      // 兼容三种配置格式：已经带 PEM 头尾直接使用；否则默认包 PKCS#1 (BEGIN RSA PRIVATE KEY) 头尾
+      let pem
+      if (String(this.privateKey).includes('-----BEGIN')) {
+        pem = String(this.privateKey)
+      } else {
+        pem = `-----BEGIN RSA PRIVATE KEY-----\n${this.privateKey}\n-----END RSA PRIVATE KEY-----`
+      }
       const sign = crypto.createSign('RSA-SHA1')
       sign.update(signStr, 'utf8')
-      const signature = sign.sign(privateKey, 'base64')
+      const signature = sign.sign(pem, 'base64')
 
       // crypto.createHash('md5').update(originStr).digest('hex')
       return signature
@@ -93,10 +99,13 @@ class AllinPay {
 
     const signStr = this.buildSignStr(paramsCopy)
 
-    const publicKey = `-----BEGIN PUBLIC KEY-----\n${this.publicKey}\n-----END PUBLIC KEY-----`
+    // 兼容两种配置格式：已经带 PEM 头尾的直接用；纯 base64 body 再包裹头尾
+    const pem = String(this.publicKey).includes('-----BEGIN')
+      ? String(this.publicKey)
+      : `-----BEGIN PUBLIC KEY-----\n${this.publicKey}\n-----END PUBLIC KEY-----`
     const verify = crypto.createVerify('RSA-SHA1')
     verify.update(signStr, 'utf8')
-    const result = verify.verify(publicKey, sign, 'base64')
+    const result = verify.verify(pem, sign, 'base64')
 
     return result
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "q-koa",
-  "version": "13.8.35",
+  "version": "13.8.37",
   "description": "",
   "main": "index.js",
   "scripts": {