From c420ab404b38b4193efdf8909173025287e03733 Mon Sep 17 00:00:00 2001 From: Blank Date: Sun, 1 Nov 2026 20:39:21 +0800 Subject: [PATCH] =?UTF-8?q?fix(network-http):=20=E4=B8=80=E6=AC=A1?= =?UTF-8?q?=E6=80=A7=E5=91=8A=E8=AD=A6=E5=86=99=E5=85=A5=E6=94=B6=E6=95=9B?= =?UTF-8?q?=E5=88=B0=E9=9D=99=E6=80=81=E6=96=B9=E6=B3=95=EF=BC=88S2696?= =?UTF-8?q?=EF=BC=8C=E4=BF=AE=E5=A4=8D=20#941=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- GameFrameX.Network.HTTP/BaseHttpHandler.cs | 47 ++++++++++++++++------ 1 file changed, 35 insertions(+), 12 deletions(-) diff --git a/GameFrameX.Network.HTTP/BaseHttpHandler.cs b/GameFrameX.Network.HTTP/BaseHttpHandler.cs index e411fb213..f393977fa 100644 --- a/GameFrameX.Network.HTTP/BaseHttpHandler.cs +++ b/GameFrameX.Network.HTTP/BaseHttpHandler.cs @@ -248,12 +248,7 @@ public bool CheckSign(string command, Dictionary paramMap, out s } // 弱密钥一次性告警（不阻断请求，fail-closed 只防“空”，告警提示“弱”） - if (secret.Length < SignSecretMinimumLength && !_weakSecretWarningLogged) - { - _weakSecretWarningLogged = true; - // Localization: Network.Http.SignSecretTooWeak - HttpSignSecret 长度不足 {0} 字符，存在被离线爆破风险，请更换为高强度随机密钥 - LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignSecretTooWeak, SignSecretMinimumLength)); - } + WarnWeakSecretOnce(secret); var sign = paramMap[GlobalConst.HttpSignKey].ToString(); var time = paramMap[GlobalConst.HttpTimestampKey].ToString(); @@ -280,12 +275,7 @@ public bool CheckSign(string command, Dictionary paramMap, out s return CheckSignVersionTwo(command, paramMap, secret, sign, time, out error); } - if (!_signVersionOneDeprecatedWarningLogged) - { - _signVersionOneDeprecatedWarningLogged = true; - // Localization: Network.Http.SignVersionOneDeprecated - HTTP 签名仍使用 v1（仅时间戳）旧口径，不防篡改与重放，建议尽快迁移到 HttpSignVersion=2 - LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignVersionOneDeprecated)); - } + WarnSignVersionOneDeprecatedOnce(); if (HmacSha256Helper.Verify(time, secret, sign)) { @@ -359,4 +349,37 @@ private static void CleanupExpiredNonces(long nowUnixSeconds) } } } + + /// + /// 弱密钥一次性告警（静态方法内写静态标记，满足 S2696；并发下最多多打一条告警，无害）。 + /// + /// + /// Logs the weak-secret warning once; the static flag is only set inside this static method. + /// + /// 当前签名密钥 / The current signing secret + private static void WarnWeakSecretOnce(string secret) + { + if (secret.Length < SignSecretMinimumLength && !_weakSecretWarningLogged) + { + _weakSecretWarningLogged = true; + // Localization: Network.Http.SignSecretTooWeak - HttpSignSecret 长度不足 {0} 字符，存在被离线爆破风险，请更换为高强度随机密钥 + LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignSecretTooWeak, SignSecretMinimumLength)); + } + } + + /// + /// v1 签名口径弃用一次性告警（静态方法内写静态标记，满足 S2696）。 + /// + /// + /// Logs the deprecated-signature-v1 warning once; the static flag is only set inside this static method. + /// + private static void WarnSignVersionOneDeprecatedOnce() + { + if (!_signVersionOneDeprecatedWarningLogged) + { + _signVersionOneDeprecatedWarningLogged = true; + // Localization: Network.Http.SignVersionOneDeprecated - HTTP 签名仍使用 v1（仅时间戳）旧口径，不防篡改与重放，建议尽快迁移到 HttpSignVersion=2 + LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignVersionOneDeprecated)); + } + } }