milky/asd-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 全量代码审计修复—安全/死代码/错误处理/配置净化

Browse Source 
P0 安全修复:
  - 支付宝回调验签 (alipay_notify BTreeMap + rsa2_verify)
  - JWT fallback 'default_secret' 改为 .expect() (panic保底)
  - 安全响应头中间件 (CSP/X-Frame-Options/HSTS)

P1 死代码清理:
  - 移除孤儿文件 src/alipay.rs (284行, 无mod注册)
  - 移除Cargo未使用依赖 (actix-files/error/log/hex/digest)
  - log::info! → tracing::info! (auth.rs)
  - 移除 config.rs server_host + 3个TOML定义

P1 质量修复:
  - 修复 weather.rs unwrap() → unwrap_or
  - 修复 auth.rs+payment.rs 错误吞咽 (add tracing::warn)
  - 修复 main.rs 3x parse().unwrap → unwrap_or

P3 运维:
  - 新增 scripts/backup-db.sh (定时备份用)
  - 新增 README.md (快速入门文档)
  - deploy.sh 集成 backup-db.sh 上传
This commit is contained in:
moira
2026-05-13 17:15:36 +08:00
parent cb483298d5
commit 27c8979690
14 changed files with 224 additions and 405 deletions
Download Patch File Download Diff File Expand all files Collapse all files

284
src/alipay.rs
View File

@@ -1,284 +0,0 @@
// src/alipay.rs — 支付宝 RSA2 签名与请求封装
use rsa::pkcs1v15::{Pkcs1v15Sign, SigningKey, VerifyingKey};
use rsa::pkcs8::{DecodePrivateKey, DecodePublicKey, EncodePrivateKey, LineEnding};
use rsa::signature::{Signer, Verifier};
use rsa::RsaPrivateKey;
use rsa::RsaPublicKey;
use sha2::{Digest, Sha256};
use std::collections::BTreeMap;
use std::env;
/// 支付宝配置（从环境变量读取）
pub struct AlipayConfig {
pub app_id: String,
pub private_key: String,
pub alipay_public_key: String,
pub gateway: String,
}
impl AlipayConfig {
pub fn from_env() -> Option<Self> {
let app_id = env::var("ALIPAY_APP_ID").ok()?;
let private_key = env::var("ALIPAY_PRIVATE_KEY").ok()?;
let alipay_public_key = env::var("ALIPAY_ALIPAY_PUBLIC_KEY").ok()?;
let gateway = env::var("ALIPAY_GATEWAY")
.unwrap_or_else(|_| "https://openapi.alipay.com/gateway.do".to_string());
Some(Self {
app_id,
private_key,
alipay_public_key,
gateway,
})
}
pub fn isConfigured() -> bool {
Self::from_env().is_some()
}
}
/// 对 map 按 key 排序后构建 query string（用于签名）
fn build_query_string(params: &BTreeMap<&str, &str>) -> String {
params
.iter()
.filter(|(_, v)| !v.is_empty())
.map(|(k, v)| format!("{}={}", k, urlencoding(v)))
.collect::<Vec<_>>()
.join("&")
}
/// URL 编码（简单实现）
fn urlencoding(s: &str) -> String {
let mut result = String::new();
for c in s.chars() {
match c {
'A'..='Z' | 'a'..='z' | '0'..='9' | '-' | '_' | '.' | '~' => result.push(c),
_ => {
for b in c.to_string().as_bytes() {
result.push_str(&format!("%{:02X}", b));
}
}
}
}
result
}
/// 使用 RSA2 (SHA256) 对内容签名
pub fn rsa2_sign(content: &str, private_key_pem: &str) -> Result<String, String> {
// 解析 PKCS8 格式的私钥
// 支持两种格式：
// 1. PEM 格式字符串 (-----BEGIN PRIVATE KEY-----...)
// 2. Base64 编码的 PEM 字符串 (用于环境变量配置)
let private_key = match RsaPrivateKey::from_pkcs8_pem(private_key_pem) {
Ok(key) => key,
Err(_) => {
// 尝试作为 base64 编码的 PEM 解码
let decoded = base64::Engine::decode(
&base64::engine::general_purpose::STANDARD,
private_key_pem,
)
.map_err(|e| format!("Base64 解码失败: {}", e))?;
let pem_str = String::from_utf8(decoded)
.map_err(|e| format!("PEM 字符串格式错误: {}", e))?;
RsaPrivateKey::from_pkcs8_pem(&pem_str)
.map_err(|e| format!("私钥解析失败: {}", e))?
}
};
let signing_key = SigningKey::<Sha256>::new(private_key);
let signature = signing_key.sign(content.as_bytes());
Ok(base64::Engine::encode(
&base64::engine::general_purpose::STANDARD,
signature.to_bytes().as_ref(),
))
}
/// 验证 RSA2 签名
pub fn rsa2_verify(content: &str, sign: &str, public_key_pem: &str) -> Result<bool, String> {
use sha2::Digest;
let public_key = RsaPublicKey::from_public_key_pem(public_key_pem)
.map_err(|e| format!("支付宝公钥解析失败: {}", e))?;
let sig_bytes = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, sign)
.map_err(|e| format!("签名 Base64 解码失败: {}", e))?;
let hashed = Sha256::digest(content.as_bytes());
public_key
.verify(rsa::Pkcs1v15Sign::new::<Sha256>(), &hashed, &sig_bytes)
.map_err(|e| format!("签名验证失败: {}", e))?;
Ok(true)
}
/// 构建支付宝请求 URL（含签名）
/// 返回 (url, sign)，sign 已 URL 编码
pub fn build_signed_request(
config: &AlipayConfig,
biz_content: &str,
other_params: Option<BTreeMap<&str, &str>>,
) -> Result<(String, String), String> {
let mut params: BTreeMap<&str, &str> = BTreeMap::new();
params.insert("app_id", &config.app_id);
params.insert("method", "alipay.trade.page.pay");
params.insert("format", "JSON");
params.insert("charset", "utf-8");
params.insert("sign_type", "RSA2");
params.insert(
"timestamp",
&chrono::Local::now().format("%Y-%m-%d %H:%M:%S").to_string(),
);
params.insert("version", "1.0");
params.insert("biz_content", biz_content);
// 加入其他参数（如 return_url, notify_url）
if let Some(ref extra) = other_params {
for (k, v) in extra {
params.insert(k, v);
}
}
// 按 RFC 3986 编码后拼接待签名内容
let sign_source: String = params
.iter()
.map(|(k, v)| format!("{}={}", k, urlencoding(v)))
.collect::<Vec<_>>()
.join("&");
let sign = rsa2_sign(&sign_source, &config.private_key)?;
// 构建最终 URL
let query = build_query_string(&params)
+ "&sign="
+ &urlencoding(&sign);
let url = config.gateway.clone() + "?" + &query;
Ok((url, sign))
}
/// 调用支付宝接口并解析响应
pub async fn call_alipay(
config: &AlipayConfig,
biz_content: &str,
other_params: Option<BTreeMap<&str, &str>>,
) -> Result<serde_json::Value, String> {
let client = reqwest::Client::builder()
.timeout(std::time::Duration::from_secs(30))
.build()
.map_err(|e| format!("HTTP 客户端创建失败: {}", e))?;
let mut params: BTreeMap<&str, &str> = BTreeMap::new();
params.insert("app_id", &config.app_id);
params.insert("method", "alipay.trade.page.pay");
params.insert("format", "JSON");
params.insert("charset", "utf-8");
params.insert("sign_type", "RSA2");
params.insert(
"timestamp",
&chrono::Local::now().format("%Y-%m-%d %H:%M:%S").to_string(),
);
params.insert("version", "1.0");
params.insert("biz_content", biz_content);
if let Some(ref extra) = other_params {
for (k, v) in extra {
params.insert(k, v);
}
}
let sign_source: String = params
.iter()
.map(|(k, v)| format!("{}={}", k, urlencoding(v)))
.collect::<Vec<_>>()
.join("&");
let sign = rsa2_sign(&sign_source, &config.private_key)?;
let query = build_query_string(&params)
+ "&sign="
+ &urlencoding(&sign);
let url = config.gateway.clone();
let resp = client
.post(&url)
.header("Content-Type", "application/x-www-form-urlencoded")
.body(query)
.send()
.await
.map_err(|e| format!("请求支付宝失败: {}", e))?;
let body = resp.text().await.map_err(|e| format!("读取响应失败: {}", e))?;
// 支付宝返回格式: alipay_trade_page_pay_response={...}&sign=xxx
let parts: Vec<&str> = body.splitn(2, "&sign=").collect();
if parts.len() != 2 {
return Err(format!("支付宝响应格式异常: {}", body));
}
let json_str = parts[0]
.strip_prefix("alipay_trade_page_pay_response=")
.unwrap_or(parts[0]);
let sign_from_alipay = parts[1];
// 验签（确保响应来自支付宝）
if !rsa2_verify(json_str, sign_from_alipay, &config.alipay_public_key)? {
return Err("支付宝响应验签失败".to_string());
}
let json: serde_json::Value =
serde_json::from_str(json_str).map_err(|e| format!("JSON 解析失败: {}", e))?;
if json.get("code").and_then(|v| v.as_str()) != Some("10000") {
let sub_msg = json.get("sub_msg").and_then(|v| v.as_str()).unwrap_or("");
return Err(format!(
"支付宝接口错误: {} - {}",
json.get("msg").and_then(|v| v.as_str()).unwrap_or("未知"),
sub_msg
));
}
Ok(json)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_url_encoding() {
assert_eq!(urlencoding("hello"), "hello");
assert_eq!(urlencoding("hello world"), "hello%20world");
assert_eq!(urlencoding("中文"), "%E4%B8%AD%E6%96%87");
}
}
#[cfg(test)]
mod signature_tests {
use super::*;
#[test]
fn test_openssl_signature_consistency() {
// This test verifies our signing matches OpenSSL
// Key from .env (same key as Python test)
let private_key_pem = std::env::var("TEST_ALIPAY_PRIVATE_KEY")
.unwrap_or_else(|_| {
// Default test key - the one we've been using
"LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2lBZ0VBQW9JQ0FRREFRQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQovZ2dFQQBFBX".to_string()
});
let content = "test content for signature comparison";
// Sign with our function
let result = rsa2_sign(content, &private_key_pem);
assert!(result.is_ok(), "Signing failed: {:?}", result.err());
let signature = result.unwrap();
tracing::debug!("Generated signature for test verification ({} chars)", signature.len());
// To verify this matches OpenSSL, you would need to run:
// echo -n "test content..." | openssl dgst -sha256 -sign key.pem | base64
}
}

1
src/config.rs
View File

@@ -16,7 +16,6 @@ pub struct AppConfig {
pub rust_log: String,
pub environment: String,
pub free_user_data_limit: i32,
pub server_host: String,
}
impl AppConfig {

16
src/handlers/auth.rs
View File

@@ -509,7 +509,7 @@ pub async fn web_login_confirm(
app_state: web::Data<AppState>,
) -> impl Responder {
let short_code = req.code.trim();
log::info!("[web_login_confirm] received code={}", short_code);
tracing::info!("[web_login_confirm] received code={}", short_code);
// 精确匹配登录码
let record: Option<(String, String, chrono::DateTime<chrono::Utc>, Option<i32>)> =
@@ -519,6 +519,7 @@ pub async fn web_login_confirm(
.bind(short_code)
.fetch_optional(pool.get_ref())
.await
.inspect_err(|e| tracing::warn!("数据库查询登录码失败: {}", e))
.ok()
.flatten();
@@ -537,10 +538,13 @@ pub async fn web_login_confirm(
// 检查是否过期
if Utc::now() > expires_at {
// 清理过期码
let _ = sqlx::query("DELETE FROM web_login_codes WHERE code = $1")
if let Err(e) = sqlx::query("DELETE FROM web_login_codes WHERE code = $1")
.bind(&code)
.execute(pool.get_ref())
.await;
.await
{
tracing::warn!("清理过期登录码失败: {}", e);
}
return HttpResponse::Ok().json(WebLoginConfirmResponse {
success: false,
token: None,
@@ -597,12 +601,14 @@ pub async fn web_login_confirm(
};
// 更新登录码记录，设置 token（而非删除，让轮询接口能查到）
sqlx::query("UPDATE web_login_codes SET token = $1 WHERE code = $2")
if let Err(e) = sqlx::query("UPDATE web_login_codes SET token = $1 WHERE code = $2")
.bind(&token)
.bind(&code)
.execute(pool.get_ref())
.await
.ok();
{
tracing::warn!("更新登录码 token 失败: {}", e);
}
info!("[WEB LOGIN CONFIRM] user_id={} is_paid={}", user_id, is_paid_active);
HttpResponse::Ok().json(WebLoginConfirmResponse {

60
src/handlers/payment.rs
View File

@@ -159,7 +159,6 @@ function confirmMockPay() {{
}
/// 验证 RSA2 签名
#[allow(dead_code)]
fn rsa2_verify(content: &str, sign: &str, public_key_pem: &str) -> Result<bool, String> {
use rsa::pkcs8::DecodePublicKey;
use rsa::RsaPublicKey;
@@ -266,7 +265,7 @@ fn extract_token(req: &HttpRequest) -> Option<String> {
}
fn get_jwt_secret() -> String {
std::env::var("JWT_SECRET").unwrap_or_else(|_| "default_secret".to_string())
std::env::var("JWT_SECRET").expect("JWT_SECRET must be set")
}
// ===== Handler: GET /payment — 套餐选择页（网页端微信扫码登录） =====
@@ -710,42 +709,56 @@ pub async fn alipay_pay_page(
// ===== Handler: POST /payment/notify — 支付宝异步回调 =====
#[derive(Debug, Deserialize)]
pub struct AlipayNotify {
pub out_trade_no: String,
pub trade_no: String,
pub trade_status: String,
pub total_amount: Option<String>,
pub app_id: Option<String>,
pub sign: Option<String>,
}
#[post("/payment/notify")]
pub async fn alipay_notify(
pool: web::Data<PgPool>,
body: web::Form<AlipayNotify>,
body: web::Form<BTreeMap<String, String>>,
) -> HttpResponse {
let body = body.into_inner();
let out_trade_no = body.get("out_trade_no").cloned().unwrap_or_default();
let trade_status = body.get("trade_status").cloned().unwrap_or_default();
tracing::info!(
"收到支付宝回调: out_trade_no={}, trade_status={}",
body.out_trade_no,
body.trade_status
out_trade_no,
trade_status
);
// 1. 检查交易状态
if body.trade_status != "TRADE_SUCCESS" && body.trade_status != "TRADE_FINISHED" {
if trade_status != "TRADE_SUCCESS" && trade_status != "TRADE_FINISHED" {
return HttpResponse::Ok().body("success");
}
// 2. 确认订单（通过 order_no，不校验 user_id）
match db::confirm_payment_order_by_orderno(pool.get_ref(), &body.out_trade_no).await {
// 2. 验证 RSA2 签名（防止伪造回调）
let Some(config) = AlipayConfig::from_env() else {
tracing::warn!("支付宝配置不存在，无法验证签名");
return HttpResponse::Ok().body("fail");
};
let sign = body.get("sign").cloned().unwrap_or_default();
// BTreeMap 已按 key 排序，直接拼接除 sign 和 sign_type 外的所有参数
let sign_source: String = body
.iter()
.filter(|(k, _)| *k != "sign" && *k != "sign_type")
.map(|(k, v)| format!("{}={}", k, v))
.collect::<Vec<_>>()
.join("&");
if let Err(e) = rsa2_verify(&sign_source, &sign, &config.alipay_public_key) {
tracing::warn!("支付宝签名验证失败: {}", e);
return HttpResponse::Ok().body("fail");
}
// 3. 确认订单（通过 order_no，不校验 user_id）
match db::confirm_payment_order_by_orderno(pool.get_ref(), &out_trade_no).await {
Ok(_) => {
tracing::info!("订单 {} 支付确认成功", body.out_trade_no);
tracing::info!("订单 {} 支付确认成功", out_trade_no);
HttpResponse::Ok().body("success")
}
Err(e) => {
tracing::error!("订单 {} 确认失败: {}", body.out_trade_no, e);
tracing::error!("订单 {} 确认失败: {}", out_trade_no, e);
HttpResponse::Ok().body("fail")
}
}
@@ -1072,10 +1085,13 @@ pub async fn payment_login_status(
// 检查是否过期
if Utc::now() > expires_at {
let _ = sqlx::query("DELETE FROM web_login_codes WHERE code = $1")
if let Err(e) = sqlx::query("DELETE FROM web_login_codes WHERE code = $1")
.bind(&db_code)
.execute(pool.get_ref())
.await;
.await
{
tracing::warn!("清理过期登录码失败: {}", e);
}
return Ok(HttpResponse::Ok().json(LoginStatusResponse {
success: false,
confirmed: false,

4
src/handlers/weather.rs
View File

@@ -83,11 +83,11 @@ pub async fn get_weather_details(
(temp_claims.openid, temp_claims.resource_id)
} else if let Some(claims) = claims_from_header() {
let weather_id = match query.get("id") {
Some(v) if v.is_i64() => v.as_i64().unwrap() as i32,
Some(v) if v.is_i64() => v.as_i64().unwrap_or(0) as i32,
Some(v) if v.is_string() => {
v.as_str().and_then(|s| s.parse::<i32>().ok()).unwrap_or(0)
}
Some(v) if v.is_number() => v.as_f64().unwrap() as i32,
Some(v) if v.is_number() => v.as_f64().map(|f| f as i32).unwrap_or(0),
_ => {
return Err(AppError::BadRequest("缺少资源ID参数（id）".to_string()));
}

31
src/main.rs
View File

@@ -1,4 +1,4 @@
use actix_web::middleware::from_fn;
use actix_web::middleware::{from_fn, DefaultHeaders};
use actix_web::{App, HttpServer, web};
use tracing::{error, info};
use openssl::ssl::{SslAcceptor, SslAcceptorBuilder, SslFiletype, SslMethod};
@@ -62,6 +62,15 @@ fn create_server_config(
.app_data(web::Data::new(pool))
.app_data(web::Data::new(http_client))
.app_data(web::Data::new(app_state))
// 安全响应头（全局中间件）
.wrap(
actix_web::middleware::DefaultHeaders::new()
.add(("X-Content-Type-Options", "nosniff"))
.add(("X-Frame-Options", "DENY"))
.add(("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data:; font-src 'self' https://cdn.jsdelivr.net; connect-src 'self'"))
.add(("Referrer-Policy", "no-referrer-when-downgrade"))
.add(("Permissions-Policy", "geolocation=(), microphone=(), camera=()"))
)
// 根路径（无需认证）
.service(root) // #[get("/")] - 返回服务信息
// 支付页面（无需认证，外部浏览器访问）
@@ -144,12 +153,26 @@ async fn main() -> std::io::Result<()> {
// 保持文件 guard 存活（使用 Box 泄漏）
std::mem::forget(_guard);
use std::str::FromStr;
let default_directive = tracing_subscriber::filter::Directive::from_str("info").unwrap();
tracing_subscriber::fmt()
.with_env_filter(
tracing_subscriber::EnvFilter::from_default_env()
.add_directive(format!("rust_backend={}", app_config.rust_log).parse().unwrap())
.add_directive(format!("actix_web={}", app_config.rust_log).parse().unwrap())
.add_directive("sqlx=warn".parse().unwrap())
.add_directive(
format!("rust_backend={}", app_config.rust_log)
.parse()
.unwrap_or(default_directive.clone())
)
.add_directive(
format!("actix_web={}", app_config.rust_log)
.parse()
.unwrap_or(default_directive)
)
.add_directive(
"sqlx=warn".parse()
.expect("sqlx=warn 是合法的日志指令")
)
)
.with_target(true)
.with_thread_ids(false) // 生产环境可开启