前端js传输明文漏洞

客官°小女子只卖身不卖艺 2023-06-30 09:22 26阅读 0赞

我这是用的是用到的是Google的aes加密算法，下载地址[https://github.com/brix/crypto-js/tree/master][https_github.com_brix_crypto-js_tree_master]，中间还是踩了一些坑，aes加密算法有多种模式，具体可看[https://www.cnblogs.com/shawWey/p/8425663.html][https_www.cnblogs.com_shawWey_p_8425663.html]  
我这是用到的是CBC模式，废话不多说，直接上代码：

> js代码

//aes加密
    function encrypt(word) { 
         var key = CryptoJS.enc.Utf8.parse("1234560405060708"); //16位
         var iv = CryptoJS.enc.Utf8.parse("1234560405060708");
         var encrypted = '';
         if (typeof(word) == 'string') { 
             var srcs = CryptoJS.enc.Utf8.parse(word);
             encrypted = CryptoJS.AES.encrypt(srcs, key, { 
                 iv: iv,
                 mode: CryptoJS.mode.CBC,
                 padding: CryptoJS.pad.Pkcs7
             });
         } else if (typeof(word) == 'object') { //对象格式的转成json字符串
             data = JSON.stringify(word);
             var srcs = CryptoJS.enc.Utf8.parse(data);
             encrypted = CryptoJS.AES.encrypt(srcs, key, { 
                 iv: iv,
                 mode: CryptoJS.mode.CBC,
                 padding: CryptoJS.pad.Pkcs7
             })
         }
         return encrypted.ciphertext.toString();
     }
     // aes解密
     function decrypt(word) { 
         var key = CryptoJS.enc.Utf8.parse("1234567890000000");
         var iv = CryptoJS.enc.Utf8.parse("1234567890000000");
         var encryptedHexStr = CryptoJS.enc.Hex.parse(word);
         var srcs = CryptoJS.enc.Base64.stringify(encryptedHexStr);
         var decrypt = CryptoJS.AES.decrypt(srcs, key, { 
             iv: iv,
             mode: CryptoJS.mode.CBC,
             padding: CryptoJS.pad.Pkcs7
         });
         var decryptedStr = decrypt.toString(CryptoJS.enc.Utf8);
         return decryptedStr.toString();
     }

java代码

package cn.stylefeng.guns.core.util;
    
    import lombok.extern.slf4j.Slf4j;
    import org.apache.commons.lang3.RandomUtils;
    import org.apache.commons.lang3.StringUtils;
    
    import javax.crypto.Cipher;
    import javax.crypto.spec.IvParameterSpec;
    import javax.crypto.spec.SecretKeySpec;
    import java.util.Random;
    
    /** * @ClassName：AESUtil * @Author：txzhang * @Date：2020/1/16—11:39 * @Description： Google aes CBC模式 加解密 **/
    @Slf4j
    public class AESCBCUtil { 
    
        private static final String ENCODING = "GBK";
    
        private static final String KEY_ALGORITHM = "AES";
        /** * 加解密算法/工作模式/填充方式 */
        private static final String DEFAULT_CIPHER_ALGORITHM = "AES/CBC/PKCS5Padding";
        /** * 填充向量 */
        public static final String FILL_VECTOR = "1234560405060708";
    
        private static final String ALL_CHAR = "0123456789abcdefghijklmnopqrstuvwxyz";
        private static final int charLength = 36;
    
        /** * 加密字符串 * * @param content 字符串 * @param password 密钥KEY * @return * @throws Exception */
        public static String encrypt(String content, String password) { 
            if (StringUtils.isAnyEmpty(content, password)) { 
                log.error("AES encryption params is null");
                return null;
            }
    
            byte[] raw = hex2byte(password);
            SecretKeySpec skeySpec = new SecretKeySpec(raw, KEY_ALGORITHM);
            Cipher cipher = null;
            try { 
                cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
                IvParameterSpec iv = new IvParameterSpec(FILL_VECTOR.getBytes());
                cipher.init(Cipher.ENCRYPT_MODE, skeySpec, iv);
                byte[] anslBytes = content.getBytes(ENCODING);
                byte[] encrypted = cipher.doFinal(anslBytes);
                return byte2hex(encrypted).toUpperCase();
            } catch (Exception e) { 
                log.error("AES encryption operation has exception,content:{},password:{}", content, password, e);
            }
            return null;
        }
    
        /** * 解密 * * @param content 解密前的字符串 * @param key 解密KEY * @return * @throws Exception * @author cdduqiang * @date 2014年4月3日 */
        public static String decrypt(String content, String key) { 
            if (StringUtils.isAnyEmpty(content, key)) { 
                log.error("AES decryption params is null");
                return null;
            }
            try { 
                byte[] raw = hex2byte(key);
                SecretKeySpec skeySpec = new SecretKeySpec(raw, KEY_ALGORITHM);
                Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
                IvParameterSpec iv = new IvParameterSpec(FILL_VECTOR.getBytes());
                cipher.init(Cipher.DECRYPT_MODE, skeySpec, iv);
                byte[] encrypted1 = hex2byte(content);
                byte[] original = cipher.doFinal(encrypted1);
                return new String(original, ENCODING);
            } catch (Exception e) { 
                log.error("AES decryption operation has exception,content:{},password:{}", content, key, e);
            }
            return null;
        }
    
        private static byte[] hex2byte(String strhex) { 
            if (strhex == null) { 
                return null;
            }
            int l = strhex.length();
            if (l % 2 == 1) { 
                return null;
            }
            byte[] b = new byte[l / 2];
            for (int i = 0; i != l / 2; i++) { 
                b[i] = (byte) Integer.parseInt(strhex.substring(i * 2, i * 2 + 2), 16);
            }
            return b;
        }
    
        public static String byte2hex(byte[] b) { 
            String hs = "";
            String stmp = "";
            for (int n = 0; n < b.length; n++) { 
                stmp = (java.lang.Integer.toHexString(b[n] & 0XFF));
                if (stmp.length() == 1) { 
                    hs = hs + "0" + stmp;
                } else { 
                    hs = hs + stmp;
                }
            }
            return hs.toUpperCase();
        }
    
        /** * key生成器 * @return */
        public static String generatorKey(int length) { 
            StringBuffer result = new StringBuffer();
            Random random = new Random();
            for (int i = 0; i < length; i++) { 
                int index = random.nextInt(charLength);
                result.append(ALL_CHAR.charAt(index));
            }
            return result.toString();
        }
    
        public static void main(String[] args) { 
            String pwd = "123456";
            String key = "1234567890000000";
            String key2 = byte2hex(key.getBytes());
            String encrypt = encrypt(pwd, key2);
            System.out.println(encrypt);
    
            System.out.println(decrypt(encrypt, key2));
        }
    }

简单贴一下controller代码

@RequestMapping(value = "/login", method = RequestMethod.POST)
    public String loginVali(HttpSession session) { 
          String username = super.getPara("username").trim();
          String password = super.getPara("password").trim();
          String remember = super.getPara("remember");
          String key = AESCBCUtil.byte2hex(AESCBCUtil.FILL_VECTOR.getBytes());
          String newPwd = AESCBCUtil.decrypt(password, key);
          Subject currentUser = ShiroKit.getSubject();
          UsernamePasswordToken token = new UsernamePasswordToken(username, newPwd.toCharArray());
    
          //如果开启了记住我功能
          if ("on".equals(remember)) { 
              token.setRememberMe(true);
          } else { 
              token.setRememberMe(false);
          }
          //
    	...
    }

参考：  
https://blog.csdn.net/xzx4959/article/details/81951037  
https://www.cnblogs.com/shawWey/p/8425663.html  
https://www.cnblogs.com/liyingying/p/6259756.html  
https://www.jianshu.com/p/6eef6cf17c25

[https_github.com_brix_crypto-js_tree_master]: https://github.com/brix/crypto-js/tree/master
[https_www.cnblogs.com_shawWey_p_8425663.html]: https://www.cnblogs.com/shawWey/p/8425663.html