feat(miniapp): 实现小程序加密网络通道服务端支持，修复 HMAC 签名与错误处理 Bug by Copilot · Pull Request #3969 · binarywang/WxJava

Copilot · 2026-04-22T13:12:48Z

微信小程序加密网络通道（getUserEncryptKey）API 已有基础实现，但存在签名计算错误、错误码判断缺陷，且缺少配套的 AES 加解密工具方法。

Bug 修复

WxMaInternetServiceImpl

HMAC-SHA256 key 格式错误：sha256() 原先用 sessionKey.getBytes(UTF_8)（base64 字符串的 UTF-8 字节）作为 HMAC key，应改为 Base64.decodeBase64(sessionKey)（原始密钥字节），与微信其他加密 API 惯例一致
错误码判断不完整：errcode == -1 仅捕获单一错误码且有 NPE 风险，改为 errcode != null && errcode != 0

新增功能

WxMaCryptUtils 新增针对加密网络通道的 AES-128-CBC 工具方法，支持 getUserEncryptKey 返回的 Base64 编码 key 和 Hex 编码 iv：

// 服务端解密小程序加密请求体
String encryptKey = keyInfo.getEncryptKey();  // Base64，来自 getUserEncryptKey
String hexIv      = keyInfo.getIv();          // Hex
String plainText  = WxMaCryptUtils.decryptWithEncryptKey(encryptKey, hexIv, encryptedBody);

// 服务端加密响应体
String encrypted = WxMaCryptUtils.encryptWithEncryptKey(encryptKey, hexIv, responseJson);

hexToBytes() 内部辅助方法含输入校验（奇数长度、非法字符），非法输入抛出 IllegalArgumentException。

Agent-Logs-Url: https://github.com/binarywang/WxJava/sessions/f3aba758-8b4a-479f-96bd-88ce00a9c176 Co-authored-by: binarywang <1343140+binarywang@users.noreply.github.com>

augmentcode · 2026-04-23T07:08:00Z

🤖 Augment PR Summary

Summary: This PR improves MiniApp “加密网络通道/getUserEncryptKey” server-side support by fixing signature calculation and strengthening error handling.

Changes:

Fixes HMAC-SHA256 signing to use the decoded session_key bytes as the HMAC key (instead of UTF-8 bytes of the Base64 string).
Updates error-code handling to treat any non-zero errcode as an error while avoiding NPE on null errcode.
Adds AES-128-CBC encrypt/decrypt helpers for the channel’s encrypt_key (Base64) + iv (Hex) values.
Adds Hex parsing validation helper and unit tests covering encrypt/decrypt round-trip.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-04-23T07:08:01Z

+        new SecretKeySpec(keyBytes, "AES"),
+        new IvParameterSpec(ivBytes));
+      return new String(cipher.doFinal(dataBytes), UTF_8);
+    } catch (Exception e) {


decryptWithEncryptKey catches all Exception and wraps it into WxRuntimeException, which means invalid hexIv (from hexToBytes’s IllegalArgumentException) won’t be observable as IllegalArgumentException by callers and the specific validation message is lost; is that intended given the Javadoc contract on hexToBytes? Other locations where this applies: weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/util/crypt/WxMaCryptUtils.java:141.

Severity: medium

Other Locations

weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/util/crypt/WxMaCryptUtils.java:141

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-04-23T07:08:01Z

+  public void testEncryptAndDecryptWithEncryptKey() {
+    String plainText = "{\"userId\":\"12345\",\"amount\":100}";
+
+    String encrypted = WxMaCryptUtils.encryptWithEncryptKey(ENCRYPT_KEY, HEX_IV, plainText);


These tests only assert encrypt/decrypt round-trip symmetry, so they can still pass even if the algorithm/encoding doesn’t match WeChat’s expected wire format (both sides could be consistently wrong). Consider adding at least one fixed test vector (known plaintext → expected ciphertext, or vice versa) from the official doc/examples to validate interoperability.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee161b56f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-23T07:10:23Z

+  public static String decryptWithEncryptKey(String encryptKey, String hexIv, String encryptedData) {
+    try {
+      byte[] keyBytes = Base64.decodeBase64(encryptKey);
+      byte[] ivBytes = hexToBytes(hexIv);


Handle getUserEncryptKey iv as 16-byte IV

decryptWithEncryptKey unconditionally hex-decodes iv (hexToBytes), but the project’s own getUserEncryptKey response examples use 16-character values like 6003f73ec441c386 (WxMaInternetResponse/WxMaInternetUserKeyInfo), which become only 8 bytes after hex decoding; AES-CBC requires a 16-byte IV, so this path will throw at runtime for documented API-shaped inputs and make the new encrypt/decrypt helpers unusable in that scenario.

Useful? React with 👍 / 👎.

Copilot

Pull request overview

该 PR 面向 weixin-java-miniapp 模块补齐/修复小程序加密网络通道（getUserEncryptKey）服务端支持：修正 HMAC 签名 key 的取值方式、完善错误码判断，并新增基于 encrypt_key + iv 的 AES-CBC 加解密工具，配套新增单测验证基础对称性。

Changes:

修复 WxMaInternetServiceImpl 的 HMAC-SHA256 key 取值（Base64 解码为原始密钥字节）与错误码判断（非 0 且非 null 才视为错误）。
在 WxMaCryptUtils 新增加密网络通道专用的 AES-128-CBC 加/解密方法与 Hex iv 转换辅助方法。
为新增加/解密方法补充对称性单测。

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/api/impl/WxMaInternetServiceImpl.java	修正签名计算的 HMAC key 字节来源，并加强 errcode 判错逻辑
weixin-java-miniapp/src/main/java/cn/binarywang/wx/miniapp/util/crypt/WxMaCryptUtils.java	新增加密网络通道 AES-CBC 加/解密能力与 Hex iv 转字节工具
weixin-java-miniapp/src/test/java/cn/binarywang/wx/miniapp/util/crypt/WxMaCryptUtilsTest.java	增加加密网络通道加/解密对称性测试

+  public static String decryptWithEncryptKey(String encryptKey, String hexIv, String encryptedData) {
+    try {
+      byte[] keyBytes = Base64.decodeBase64(encryptKey);
+      byte[] ivBytes = hexToBytes(hexIv);
+      byte[] dataBytes = Base64.decodeBase64(encryptedData);
+
+      Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+      cipher.init(Cipher.DECRYPT_MODE,
+        new SecretKeySpec(keyBytes, "AES"),
+        new IvParameterSpec(ivBytes));
+      return new String(cipher.doFinal(dataBytes), UTF_8);
+    } catch (Exception e) {
+      throw new WxRuntimeException("AES解密失败！", e);
+    }


+  public static String encryptWithEncryptKey(String encryptKey, String hexIv, String data) {
+    try {
+      byte[] keyBytes = Base64.decodeBase64(encryptKey);
+      byte[] ivBytes = hexToBytes(hexIv);
+
+      Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+      cipher.init(Cipher.ENCRYPT_MODE,
+        new SecretKeySpec(keyBytes, "AES"),
+        new IvParameterSpec(ivBytes));
+      return Base64.encodeBase64String(cipher.doFinal(data.getBytes(UTF_8)));
+    } catch (Exception e) {
+      throw new WxRuntimeException("AES加密失败！", e);
+    }


+  // 模拟来自 getUserEncryptKey 接口返回的 encrypt_key（Base64）和 iv（Hex，32位即16字节）
+  private static final String ENCRYPT_KEY = "VI6BpyrK9XH4i4AIGe86tg==";
+  private static final String HEX_IV = "6003f73ec441c3866003f73ec441c386";
+


+  @Test
+  public void testEncryptAndDecryptWithEncryptKey() {
+    String plainText = "{\"userId\":\"12345\",\"amount\":100}";
+
+    String encrypted = WxMaCryptUtils.encryptWithEncryptKey(ENCRYPT_KEY, HEX_IV, plainText);
+    assertThat(encrypted).isNotNull().isNotEmpty();
+
+    String decrypted = WxMaCryptUtils.decryptWithEncryptKey(ENCRYPT_KEY, HEX_IV, encrypted);
+    assertThat(decrypted).isEqualTo(plainText);
+  }
+
+  /**
+   * 测试加密网络通道的加解密对称性（不同明文）.
+   */
+  @Test
+  public void testEncryptDecryptSymmetryWithEncryptKey() {
+    String plainText = "hello miniprogram";
+
+    String encrypted = WxMaCryptUtils.encryptWithEncryptKey(ENCRYPT_KEY, HEX_IV, plainText);
+    String decrypted = WxMaCryptUtils.decryptWithEncryptKey(ENCRYPT_KEY, HEX_IV, encrypted);
+    assertThat(decrypted).isEqualTo(plainText);
+  }


+  private static byte[] hexToBytes(String hex) {
+    if (hex == null || hex.length() % 2 != 0) {
+      throw new IllegalArgumentException("无效的十六进制字符串格式：长度必须为偶数");
+    }
+    int len = hex.length();
+    byte[] data = new byte[len / 2];
+    for (int i = 0; i < len; i += 2) {
+      int high = Character.digit(hex.charAt(i), 16);
+      int low = Character.digit(hex.charAt(i + 1), 16);
+      if (high == -1 || low == -1) {
+        throw new IllegalArgumentException("无效的十六进制字符串格式：包含非法字符 '" + hex.charAt(high == -1 ? i : i + 1) + "'");
+      }
+      data[i / 2] = (byte) ((high << 4) + low);
+    }


Initial plan

9d5bb1a

Copilot AI assigned Copilot and binarywang Apr 22, 2026

Copilot started work on behalf of binarywang April 22, 2026 13:12 View session

Copilot AI linked an issue Apr 22, 2026 that may be closed by this pull request

小程序加密网络通道 #3967

Open

Copilot AI and others added 2 commits April 22, 2026 13:27

实现小程序加密网络通道：修复 HMAC 签名、错误处理，新增 AES 工具方法及单元测试

96eaeb2

Agent-Logs-Url: https://github.com/binarywang/WxJava/sessions/f3aba758-8b4a-479f-96bd-88ce00a9c176 Co-authored-by: binarywang <1343140+binarywang@users.noreply.github.com>

修复代码审查问题：hexToBytes 增加输入验证，改进测试代码质量

ee161b5

Agent-Logs-Url: https://github.com/binarywang/WxJava/sessions/f3aba758-8b4a-479f-96bd-88ce00a9c176 Co-authored-by: binarywang <1343140+binarywang@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add encrypted network channel for mini program~~ feat(miniapp): 实现小程序加密网络通道服务端支持，修复 HMAC 签名与错误处理 Bug Apr 22, 2026

Copilot finished work on behalf of binarywang April 22, 2026 13:31

Copilot AI requested a review from binarywang April 22, 2026 13:31

binarywang marked this pull request as ready for review April 23, 2026 07:04

Copilot AI review requested due to automatic review settings April 23, 2026 07:04

Copilot started reviewing on behalf of binarywang April 23, 2026 07:05 View session

augmentcode Bot reviewed Apr 23, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Apr 23, 2026

View reviewed changes

Copilot AI reviewed Apr 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(miniapp): 实现小程序加密网络通道服务端支持，修复 HMAC 签名与错误处理 Bug#3969

feat(miniapp): 实现小程序加密网络通道服务端支持，修复 HMAC 签名与错误处理 Bug#3969
Copilot wants to merge 3 commits intodevelopfrom
copilot/add-encrypted-network-channel

Copilot AI commented Apr 22, 2026 •

edited

Loading

Uh oh!

augmentcode Bot commented Apr 23, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Apr 23, 2026 •

edited

Loading

Uh oh!

augmentcode Bot Apr 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug 修复

新增功能

Uh oh!

augmentcode Bot commented Apr 23, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 22, 2026 •

edited

Loading

augmentcode Bot Apr 23, 2026 •

edited

Loading

augmentcode Bot Apr 23, 2026 •

edited

Loading