Merge branch 'pr/227'

Automated security fix generated by OrbisAI Security

.github/workflows/pr-reviewer.yml

@@ -1,46 +0,0 @@
-name: opencode-review
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-permissions:
-  contents: read
-
-jobs:
-  review:
-    # 跳过 fork 来的 PR：GitHub 不会把 secrets 传给 fork PR 触发的工作流，
-    # 跑了也必然失败，所以直接跳过避免噪音（平台限制，非配置问题）。
-    if: github.event.pull_request.head.repo.fork == false
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate bot token
-        id: token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-          token: ${{ steps.token.outputs.token }}
-
-      - name: Configure git identity
-        run: |
-          git config --global user.name "takanashi-hoshino-agent[bot]"
-          git config --global user.email "takanashi-hoshino-agent[bot]@users.noreply.github.com"
-
-      - name: Run opencode review
-        uses: anomalyco/opencode/github@latest
-        env:
-          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
-          # 用自定义 GitHub App 生成的 bot token，跟原 opencode.yml 一致，
-          # 评论 PR / 提交都走 takanashi-hoshino-agent[bot] 的身份。
-          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
-        with:
-          model: opencode/deepseek-v4-flash-free
-          use_github_token: true
-          prompt: ${{ secrets.OPENCODE_PROMPT }}

module/decrypt.js

@@ -48,7 +48,7 @@ module.exports = async (query, request) => {
       case 'linuxapi': {
         if (isReq) {
           const pureHex = data.replace(/\s/g, '')
-          const decrypted = aesDecrypt(pureHex, linuxapiKey, '', 'hex')
+          const decrypted = aesDecrypt(pureHex, 'ecb', linuxapiKey, '', 'hex')
           result = JSON.parse(decrypted.toString(CryptoJS.enc.Utf8))
         } else {
           result = typeof data === 'string' ? JSON.parse(data) : data

public/audio_match_demo/index.html

@@ -255,9 +255,13 @@
         }
         logs.write(`[index] 查询完成。结果数量=${resp.data.result.length}`)
         for (var song of resp.data.result) {
-          logs.write(
-            `[result] <a target="_blank" href="https://music.163.com/song?id=${song.song.id}">${song.song.name} - ${song.song.album.name} (${song.startTime / 1000}s)</a>`
-          )
+          var a = document.createElement('a');
+          a.href = 'https://music.163.com/song?id=' + encodeURIComponent(song.song.id);
+          a.target = '_blank';
+          a.textContent = song.song.name + ' - ' + song.song.album.name + ' (' + (song.startTime / 1000) + 's)';
+          logs.appendChild(document.createTextNode('[result] '));
+          logs.appendChild(a);
+          logs.appendChild(document.createElement('br'));
         }
       })
     })

util/crypto.js

@@ -34,12 +34,12 @@ const aesEncrypt = (text, mode, key, iv, format = 'base64') => {
 
   return encrypted.ciphertext.toString().toUpperCase()
 }
-const aesDecrypt = (ciphertext, key, iv, format = 'base64') => {
+const aesDecrypt = (ciphertext, mode, key, iv, format = 'base64') => {
   let bytes
   if (format === 'base64') {
     bytes = CryptoJS.AES.decrypt(ciphertext, CryptoJS.enc.Utf8.parse(key), {
       iv: CryptoJS.enc.Utf8.parse(iv),
-      mode: CryptoJS.mode.ECB,
+      mode: CryptoJS.mode[mode.toUpperCase()],
       padding: CryptoJS.pad.Pkcs7,
     })
   } else {
@@ -48,7 +48,7 @@ const aesDecrypt = (ciphertext, key, iv, format = 'base64') => {
       CryptoJS.enc.Utf8.parse(key),
       {
         iv: CryptoJS.enc.Utf8.parse(iv),
-        mode: CryptoJS.mode.ECB,
+        mode: CryptoJS.mode[mode.toUpperCase()],
         padding: CryptoJS.pad.Pkcs7,
       },
     )
@@ -97,7 +97,7 @@ const eapi = (url, object) => {
 const eapiResDecrypt = (encryptedParams, aeapi = false) => {
   // 使用aesDecrypt解密参数
   try {
-    const decrypted = aesDecrypt(encryptedParams, eapiKey, '', 'hex') // WordArray
+    const decrypted = aesDecrypt(encryptedParams, 'ecb', eapiKey, '', 'hex') // WordArray
 
     if (aeapi) {
       // 带压缩的解密：先转 Base64 再解压
@@ -120,6 +120,7 @@ const eapiReqDecrypt = (encryptedParams) => {
   // 使用 aesDecrypt 解密参数
   const decryptedData = aesDecrypt(
     encryptedParams,
+    'ecb',
     eapiKey,
     '',
     'hex',