Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

开启加密后出现verification failed event,疑似代码逻辑问题 #46

Closed
TimeBather opened this issue Apr 20, 2023 · 3 comments
Closed

Comments

@TimeBather
Copy link

复现流程:

  • 打开飞书的事件加密功能
  • 使用"自定义适配器"模式
  • 发送事件,出现verification failed event

代码片段:

    @Post()
    async on_event(@Body() body,@Headers() headers){
        const data = {
            reqData:body,
            headers
        }
        const { isChallenge, challenge } = generateChallenge(body, {
            encryptKey: this.lark_dispatcher.encryptKey
        });
        if(isChallenge){
            return challenge
        }
        const result = await this.lark_dispatcher.invoke(data)
        if(result instanceof CardActionHandler)
            return result
        return {}
    }

经过追踪,疑似checkIsEventValidated函数中(

timestamp + nonce + this.encryptKey + JSON.stringify(data);
),直接对data作了Hash运算,而此时的data中存在“headers”对象,因此Hash不一致

@TimeBather
Copy link
Author

发现是因为传入的data数据结构为{reqBody,header}而非{...reqBody,header}所致,建议在“自定义接入”中明确该点

@TimeBather
Copy link
Author

发现上述原因和本问题并未冲突,reopen了

@TimeBather TimeBather reopened this Apr 20, 2023
@mazhe-nerd
Copy link
Collaborator

是的同学,对事件的验证是针对data本身而言的,如果参杂了其它内容会校验不通过;将headers挂在data的原型上面就可以了。

UNICKCHENG added a commit to UNICKCHENG/node-sdk that referenced this issue May 8, 2023
- add adapator for NextJS
- add adapator for custom

see larksuite#32, larksuite#46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants