MoeFurina/NeteaseCloudMusicApiEnhanced
1
0
Fork 0
mirror of https://github.com/NeteaseCloudMusicApiEnhanced/api-enhanced.git synced 2026-08-12 17:10:37 +00:00
Code Issues Packages Projects Releases Activity

fix: V-001 security vulnerability

Browse Source 
Automated security fix generated by OrbisAI Security
This commit is contained in:
anupamme 2026-08-02 08:35:02 +00:00
parent a79a2d9ef6
commit 9214cb945f
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
module/decrypt.js
View File

@ -48,7 +48,7 @@ module.exports = async (query, request) => {
case 'linuxapi': { case 'linuxapi': {
if (isReq) { if (isReq) {
const pureHex = data.replace(/\s/g, '') const pureHex = data.replace(/\s/g, '')
const decrypted = aesDecrypt(pureHex, linuxapiKey, '', 'hex') const decrypted = aesDecrypt(pureHex, 'ecb', linuxapiKey, '', 'hex')
result = JSON.parse(decrypted.toString(CryptoJS.enc.Utf8)) result = JSON.parse(decrypted.toString(CryptoJS.enc.Utf8))
} else { } else {
result = typeof data === 'string' ? JSON.parse(data) : data result = typeof data === 'string' ? JSON.parse(data) : data

9
util/crypto.js
View File

@ -34,12 +34,12 @@ const aesEncrypt = (text, mode, key, iv, format = 'base64') => {
return encrypted.ciphertext.toString().toUpperCase() return encrypted.ciphertext.toString().toUpperCase()
} }
const aesDecrypt = (ciphertext, key, iv, format = 'base64') => { const aesDecrypt = (ciphertext, mode, key, iv, format = 'base64') => {
let bytes let bytes
if (format === 'base64') { if (format === 'base64') {
bytes = CryptoJS.AES.decrypt(ciphertext, CryptoJS.enc.Utf8.parse(key), { bytes = CryptoJS.AES.decrypt(ciphertext, CryptoJS.enc.Utf8.parse(key), {
iv: CryptoJS.enc.Utf8.parse(iv), iv: CryptoJS.enc.Utf8.parse(iv),
mode: CryptoJS.mode.ECB, mode: CryptoJS.mode[mode.toUpperCase()],
padding: CryptoJS.pad.Pkcs7, padding: CryptoJS.pad.Pkcs7,
}) })
} else { } else {
@ -48,7 +48,7 @@ const aesDecrypt = (ciphertext, key, iv, format = 'base64') => {
CryptoJS.enc.Utf8.parse(key), CryptoJS.enc.Utf8.parse(key),
{ {
iv: CryptoJS.enc.Utf8.parse(iv), iv: CryptoJS.enc.Utf8.parse(iv),
mode: CryptoJS.mode.ECB, mode: CryptoJS.mode[mode.toUpperCase()],
padding: CryptoJS.pad.Pkcs7, padding: CryptoJS.pad.Pkcs7,
}, },
) )
@ -97,7 +97,7 @@ const eapi = (url, object) => {
const eapiResDecrypt = (encryptedParams, aeapi = false) => { const eapiResDecrypt = (encryptedParams, aeapi = false) => {
// 使用aesDecrypt解密参数 // 使用aesDecrypt解密参数
try { try {
const decrypted = aesDecrypt(encryptedParams, eapiKey, '', 'hex') // WordArray const decrypted = aesDecrypt(encryptedParams, 'ecb', eapiKey, '', 'hex') // WordArray
if (aeapi) { if (aeapi) {
// 带压缩的解密：先转 Base64 再解压 // 带压缩的解密：先转 Base64 再解压
@ -120,6 +120,7 @@ const eapiReqDecrypt = (encryptedParams) => {
// 使用 aesDecrypt 解密参数 // 使用 aesDecrypt 解密参数
const decryptedData = aesDecrypt( const decryptedData = aesDecrypt(
encryptedParams, encryptedParams,
'ecb',
eapiKey, eapiKey,
'', '',
'hex', 'hex',