dachui/order_site
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(pdd-extension): 增强 MMS Cookie 多维嗅探与 PASS_ID 校验，新增插件运行日志与升级 v1.1.0

Browse Source
This commit is contained in:
yml2213
2026-09-14 12:50:54 +08:00
parent 9fb27b0ad2
commit a47661e67e
9 changed files with 594 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/backend/src/services/platforms/pdd/pdd-crypto-service.test.ts
+2 -2
View File
@@ -40,12 +40,12 @@ test('decryptPddExtensionPayload successfully decrypts valid envelope', () => {
assert.equal(decrypted.nonce, payload.nonce)
})
test('decryptPddExtensionPayload rejects expired timestamp (> 60s)', () => {
test('decryptPddExtensionPayload rejects expired timestamp (> 300s)', () => {
const kp = getOrCreatePddRsaKeyPair()
const payload = {
shopId: 'store_test_01',
cookie: 'PASS_ID=test_pass;',
timestamp: Date.now() - 120_000, // 2 minutes ago
timestamp: Date.now() - 600_000, // 10 minutes ago (> 300s)
nonce: 'nonce-expired-' + Math.random().toString(36).slice(2),
}
apps/backend/src/services/platforms/pdd/pdd-crypto-service.ts
+3 -3
View File
@@ -52,10 +52,10 @@ export interface PddDecryptedCookiePayload {
nonce: string
}
// In-memory Nonce cache for anti-replay attacks (TTL: 3 minutes)
// In-memory Nonce cache for anti-replay attacks (TTL: 6 minutes)
const seenNonces = new Map<string, number>()
const NONCE_TTL_MS = 180_000
const MAX_TIMESTAMP_SKEW_MS = 60_000
const NONCE_TTL_MS = 360_000
const MAX_TIMESTAMP_SKEW_MS = 300_000
function cleanupExpiredNonces() {
const now = Date.now()