larksuite / node-sdk

larksuite open sdk for nodejs
MIT License
131 stars 26 forks source link

开启加密后出现verification failed event,疑似代码逻辑问题 #46

Closed TimeBather closed 1 year ago

TimeBather commented 1 year ago

复现流程:

代码片段:

    @Post()
    async on_event(@Body() body,@Headers() headers){
        const data = {
            reqData:body,
            headers
        }
        const { isChallenge, challenge } = generateChallenge(body, {
            encryptKey: this.lark_dispatcher.encryptKey
        });
        if(isChallenge){
            return challenge
        }
        const result = await this.lark_dispatcher.invoke(data)
        if(result instanceof CardActionHandler)
            return result
        return {}
    }

经过追踪,疑似checkIsEventValidated函数中( https://github.com/larksuite/node-sdk/blob/6bf94c9aecdce0913e20a93668ec073455a8d6d1/dispatcher/request-handle.ts#L104 ),直接对data作了Hash运算,而此时的data中存在“headers”对象,因此Hash不一致

TimeBather commented 1 year ago

发现是因为传入的data数据结构为{reqBody,header}而非{...reqBody,header}所致,建议在“自定义接入”中明确该点

TimeBather commented 1 year ago

发现上述原因和本问题并未冲突,reopen了

mazhe-nerd commented 1 year ago

是的同学,对事件的验证是针对data本身而言的,如果参杂了其它内容会校验不通过;将headers挂在data的原型上面就可以了。