Skip to content

fix(network-http): 一次性告警写入收敛到静态方法（S2696） #946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlianBlank merged 1 commit into from
Nov 1, 2026
+35 −12
Merged

fix(network-http): 一次性告警写入收敛到静态方法（S2696） #946

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 35 additions & 12 deletions GameFrameX.Network.HTTP/BaseHttpHandler.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,12 +248,7 @@ public bool CheckSign(string command, Dictionary<string, object> paramMap, out s
}

// 弱密钥一次性告警（不阻断请求，fail-closed 只防“空”，告警提示“弱”）
if (secret.Length < SignSecretMinimumLength && !_weakSecretWarningLogged)
{
_weakSecretWarningLogged = true;
// Localization: Network.Http.SignSecretTooWeak - HttpSignSecret 长度不足 {0} 字符，存在被离线爆破风险，请更换为高强度随机密钥
LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignSecretTooWeak, SignSecretMinimumLength));
}
WarnWeakSecretOnce(secret);

var sign = paramMap[GlobalConst.HttpSignKey].ToString();
var time = paramMap[GlobalConst.HttpTimestampKey].ToString();
Expand All @@ -280,12 +275,7 @@ public bool CheckSign(string command, Dictionary<string, object> paramMap, out s
return CheckSignVersionTwo(command, paramMap, secret, sign, time, out error);
}

if (!_signVersionOneDeprecatedWarningLogged)
{
_signVersionOneDeprecatedWarningLogged = true;
// Localization: Network.Http.SignVersionOneDeprecated - HTTP 签名仍使用 v1（仅时间戳）旧口径，不防篡改与重放，建议尽快迁移到 HttpSignVersion=2
LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignVersionOneDeprecated));
}
WarnSignVersionOneDeprecatedOnce();

if (HmacSha256Helper.Verify(time, secret, sign))
{
Expand Down Expand Up @@ -359,4 +349,37 @@ private static void CleanupExpiredNonces(long nowUnixSeconds)
}
}
}

/// <summary>
/// 弱密钥一次性告警（静态方法内写静态标记，满足 S2696；并发下最多多打一条告警，无害）。
/// </summary>
/// <remarks>
/// Logs the weak-secret warning once; the static flag is only set inside this static method.
/// </remarks>
/// <param name="secret">当前签名密钥 / The current signing secret</param>
private static void WarnWeakSecretOnce(string secret)
{
if (secret.Length < SignSecretMinimumLength && !_weakSecretWarningLogged)
{
_weakSecretWarningLogged = true;
// Localization: Network.Http.SignSecretTooWeak - HttpSignSecret 长度不足 {0} 字符，存在被离线爆破风险，请更换为高强度随机密钥
LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignSecretTooWeak, SignSecretMinimumLength));
}
}

/// <summary>
/// v1 签名口径弃用一次性告警（静态方法内写静态标记，满足 S2696）。
/// </summary>
/// <remarks>
/// Logs the deprecated-signature-v1 warning once; the static flag is only set inside this static method.
/// </remarks>
private static void WarnSignVersionOneDeprecatedOnce()
{
if (!_signVersionOneDeprecatedWarningLogged)
{
_signVersionOneDeprecatedWarningLogged = true;
// Localization: Network.Http.SignVersionOneDeprecated - HTTP 签名仍使用 v1（仅时间戳）旧口径，不防篡改与重放，建议尽快迁移到 HttpSignVersion=2
LogHelper.Warning(LocalizationService.GetString(Localization.Keys.NetworkHttp.SignVersionOneDeprecated));
}
}
}
Loading