MoeFurina/NeteaseCloudMusicApiEnhanced
1
0
Fork 0
mirror of https://github.com/NeteaseCloudMusicApiEnhanced/api-enhanced.git synced 2026-08-12 08:50:38 +00:00
Code Issues Packages Projects Releases Activity

fix: V-001 security vulnerability

Browse Source 
Automated security fix generated by OrbisAI Security
This commit is contained in:
anupamme 2026-08-02 08:35:02 +00:00
parent a79a2d9ef6
commit 9214cb945f
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
module/decrypt.js
View File

@ -48,7 +48,7 @@ module.exports = async (query, request) => {
case 'linuxapi': {
if (isReq) {
const pureHex = data.replace(/\s/g, '')
const decrypted = aesDecrypt(pureHex, linuxapiKey, '', 'hex')
const decrypted = aesDecrypt(pureHex, 'ecb', linuxapiKey, '', 'hex')
result = JSON.parse(decrypted.toString(CryptoJS.enc.Utf8))
} else {
result = typeof data === 'string' ? JSON.parse(data) : data

9
util/crypto.js
View File

@ -34,12 +34,12 @@ const aesEncrypt = (text, mode, key, iv, format = 'base64') => {
return encrypted.ciphertext.toString().toUpperCase()
}
const aesDecrypt = (ciphertext, key, iv, format = 'base64') => {
const aesDecrypt = (ciphertext, mode, key, iv, format = 'base64') => {
let bytes
if (format === 'base64') {
bytes = CryptoJS.AES.decrypt(ciphertext, CryptoJS.enc.Utf8.parse(key), {
iv: CryptoJS.enc.Utf8.parse(iv),
mode: CryptoJS.mode.ECB,
mode: CryptoJS.mode[mode.toUpperCase()],
padding: CryptoJS.pad.Pkcs7,
})
} else {
@ -48,7 +48,7 @@ const aesDecrypt = (ciphertext, key, iv, format = 'base64') => {
CryptoJS.enc.Utf8.parse(key),
{
iv: CryptoJS.enc.Utf8.parse(iv),
mode: CryptoJS.mode.ECB,
mode: CryptoJS.mode[mode.toUpperCase()],
padding: CryptoJS.pad.Pkcs7,
},
)
@ -97,7 +97,7 @@ const eapi = (url, object) => {
const eapiResDecrypt = (encryptedParams, aeapi = false) => {
// 使用aesDecrypt解密参数
try {
const decrypted = aesDecrypt(encryptedParams, eapiKey, '', 'hex') // WordArray
const decrypted = aesDecrypt(encryptedParams, 'ecb', eapiKey, '', 'hex') // WordArray
if (aeapi) {
// 带压缩的解密：先转 Base64 再解压
@ -120,6 +120,7 @@ const eapiReqDecrypt = (encryptedParams) => {
// 使用 aesDecrypt 解密参数
const decryptedData = aesDecrypt(
encryptedParams,
'ecb',
eapiKey,
'',
'hex',