From a18f75f7354a9922e2dd4c40cd4c47b1b8360562 Mon Sep 17 00:00:00 2001 From: db_huang <18006480240@163.com> Date: Mon, 2 Nov 2026 11:45:55 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E6=94=AF=E4=BB=98=E7=8A=B6?= =?UTF-8?q?=E6=80=81bug?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../alipay_provider.cpython-313.pyc | Bin 27336 -> 27403 bytes backend/app/alipay_provider.py | 6 +++++- ...ipay_provider.cpython-313-pytest-9.1.1.pyc | Bin 35375 -> 38749 bytes backend/tests/test_alipay_provider.py | 17 +++++++++++++++++ 4 files changed, 22 insertions(+), 1 deletion(-) diff --git a/backend/app/__pycache__/alipay_provider.cpython-313.pyc b/backend/app/__pycache__/alipay_provider.cpython-313.pyc index 9856ee09e258cbf05e89bee59a1df989d89d82c4..cf6684212b06d417f2ec88dec101fa49c58b95f9 100644 GIT binary patch delta 1145 zcmYk4ZD<^25XX0JZ};+Yn~O=VAW7rp)U?-Vawb-dmtG8MV^iB&`;trLXznF@X4C6k zeD==j7fB7iQ3}e4R-rL!ttM=?zX1YNc5apx-ofu{}*))&PTToJ{~<_>cWf;j2|&FW=_PTTXpkr zE;|)XX28qTD$ z*xVL^7ckPcJ5a8X>epZK1PY$O6;HU}370j=-BOlZZgsg%a%sm>Z$xIYWsl36YkLRa zT`PX?=Pvlrs_*zzh99i+otvC+)wmvCJ;*}A|b-O03}XL4i7blfz>|8?IB`;`)< zl&x>VGfriR%vNh?&@V$T8bbx;FLDH}{wLG0@mDg%4MM;v*ezNZ&5W~zPaNV|wij_> zd#Cabnf;bJJR^tJ&WYbS{s-eX#x=r_c%S&6BI~RwRtKh`vB0Hdj=OV*u1G|?HMjPw6pQ54*krm>O zg#OWB&`Z%kgOE507<|7%W;hut!^NP&lBmX4M!RZna$mOYB7QyEuRKJd=(&ThD-E@r zA$D?m44Wd~hCqbLM~kckVg& zL&pK-?*F8IPlp?NBbn(lGFcWN&0fy|NkaDUOID_`gsz@O^$((^7jp}J~Db-1o( z>Q*?wQbt3c&?jd!Jn`e$;wv<_93z-cLRD4O(9n>a&*D}5ZQb^gPnw!o_W_`Q*PFJ1 zz+m%V%dT>|z^G&_As7x>&hhN;qirD_*5KJ_K}?gdQXSlw1MedW@_LYmt*|e$IHzctVKE<3t|J%D;@oj8eu&bam7V4K!_o zYVLSn3V@N=7N?5@D~K0k0X!A+Kq;P$H9#3Yh_yQ1l#+ly#1GMGjm9^@Lwpx+ub$5` zw;{V32WDsBGA)sovR_IKFrBD(2FPoaO%X!EAn$_T*RuS*W~d9w)-YBwxEsrD4)!F?d@4U^%0?FaEcDAgX_?HV zvbm&8r_BC7dw&e~=L#Y`+AgS;qk4wjb;O>3ip$!;SVb9=ZxJ2eFOPkMEkRAmUu6sB zPpZaL5}en_)eAVZVS&2Pv%kc9pS~@}wyvL6N2P_4^kA*6Kuf3Wpp>D@xAc-n89dh1 z33N$5Uy*lsJ6!`~SduvxyulXUTSM4RIl{t!j2^}~j%SvOD3x+aeaz$lZsOiwWP`o9 yUzhR?TkV6$=fYk}OV9S@C2z0Yh>W5yTM3<5n?3C*gTR@#w;H{Q3)TH>9sCcv=_=F! diff --git a/backend/app/alipay_provider.py b/backend/app/alipay_provider.py index b3fa2d8..4e4f23a 100644 --- a/backend/app/alipay_provider.py +++ b/backend/app/alipay_provider.py @@ -139,7 +139,11 @@ def _certificate_public_key(certificate) -> str: raise AlipayTransferError("支付宝证书必须包含 RSA 公钥") return key.public_bytes( encoding=serialization.Encoding.PEM, - format=serialization.PublicFormat.PKCS1, + # alipay-sdk-python's verify_with_rsa uses + # rsa.PublicKey.load_pkcs1_openssl_pem(), which expects an X.509 + # SubjectPublicKeyInfo (BEGIN PUBLIC KEY), not PKCS#1's + # BEGIN RSA PUBLIC KEY structure. + format=serialization.PublicFormat.SubjectPublicKeyInfo, ).decode("ascii") diff --git a/backend/tests/__pycache__/test_alipay_provider.cpython-313-pytest-9.1.1.pyc b/backend/tests/__pycache__/test_alipay_provider.cpython-313-pytest-9.1.1.pyc index b6a2933bed8ced3607b338fa5753b192a66396cb..ce58eed18aed15194c32e952dbe2f7d3badfbff3 100644 GIT binary patch delta 2438 zcma)8Urbw77(eH73;jdewS|@81{cO6l|Q4CB5YDw8Q@^Dg-f@Q#dW1zpg?cyxn&bJ zQl`t?UN)EG9(*lc^iVKEwA;=e~9TDw_t&6GD|jByc@O&^Tkxov5QOI&mFo!|ML z?|k3yeD^ySZoI|a|A@1!o6SZ9zZ<{(Jk!*8%~FL|uRWbMij~!f)J|d7)?5Ds&tXJQ zEma7&bqJlbUPmGpxgj)&Wh5|+hOmtNXhcW9}3sz-inI~Gf;(TrX! z^KdK=LNZ5FJA^7fSC2ed26=E6$R+*~nv7R8$h@eJj>3LjeknTHm~)=EfskkrjZ`@8 zrWU)A*7Q}z0==BZ%$X0@!dFf z)Q@R$xq=(nLEXKML`goAtoQ3jYI4bn2ALnVjtE6W4n`*n2Z_EtQvVo_4~slLdtB`3 zH-f)>?~4dU{rO`K;E6GWPHf4Cqc@LNRMjJ~+^>V0nvWl9=RACNQM7ETMO&AV9-K03 z^*A}B)x(mjhY?$gUAa*!-9J?cp0$=yYrX(bKP&h@L#xl5=()bF^v6B}ojOoQ4;!=* zn`q#Gi<Cg=dabl((I(pc<~FR&ELx$z9;>Cv^SYM}-B>n4!9SluF2^uoZQ#PB z0p58SBaFgG4+N)LWAo#4;ZQ(&H5Qd6Ij-twrG6J+J&fg(YDA$54g_gqs z<9Y)aFTRdOsm$+4G$3LI!i801A&iS7>>a757zv*a#-#u#P?$(znb=?;yCJeV8<&)L zAS97^crqMfZiNU>s+Z3R-qzGw*!%!eD0VQ9meH!CCgX6W9ImvZDOuh`DuAX@dHbxU zfz-hi3f~5L6n5I2J~Lp_42G3KVF!G45k2Ivq4@y^T39U>nJ=02~XLX6&pjYKV-yY4jFIsa4)}(g06pik1IaF7OEX3l` zDH4oLFSJev7bC%VD>O$W91owCl-8iK5Q#`}5)Ns1K&_aPWQk}kQRpC2#_~BgI;M7W z%aC7TnMlk`G83Xdz2Ho!h9lY)8j=>&t#i@fL?AXBQrv-POp+C4E)bIiIyZBFc8?q4<8u6ADTO!B@r&t{x0DQ647q_ZXM+zlY(^roC33>a_P z*`qPOl+&j%zLd$A0Uzy2^S(=+8?!992VBPnmnzKI0yrlM+rjIuCLtdWyg`sQ18)$N z#gHcH++BpBSS*Uh_Y~nxp|d<#$f13nLfRjNm5HSlT}hb3E7h;>!(0ib$1aG?L##dP z;B~{NZxC?Nr%%=Q2WO?@p0+O14=Ws|-(RT5!z+JX_yCt4Vf%*Z`xkdrlNT6%Z=<<$ z4ctKn>4S^2x)ZSa_sXd^f*1?*t4rUOvIZk3=+(ey delta 217 zcmcb+j%ocACce+Syj%=GkpAj<)?(F(d=iY8CaPa%NoUj)-OR$6ShKmiYX>Xy%a073 z-6mKwGJRs0+&nQ@$AFQ6p-2&^O_Q-mAIL5SVupqyK_GdH!!0p8HNw=uvPcUk`jKHW z(G)J diff --git a/backend/tests/test_alipay_provider.py b/backend/tests/test_alipay_provider.py index 6aebb0a..e11e54b 100644 --- a/backend/tests/test_alipay_provider.py +++ b/backend/tests/test_alipay_provider.py @@ -230,6 +230,23 @@ def test_root_certificate_serial_ignores_non_rsa_certificates(): assert alipay_provider._root_certificate_serial([sm2, rsa, ecc]) == expected +def test_certificate_public_key_uses_sdk_compatible_subject_public_key_info(): + from cryptography.hazmat.primitives.asymmetric import rsa as crypto_rsa + import rsa as sdk_rsa + + private_key = crypto_rsa.generate_private_key(public_exponent=65537, key_size=2048) + + class FakeCertificate: + def public_key(self): + return private_key.public_key() + + public_key = alipay_provider._certificate_public_key(FakeCertificate()) + + assert public_key.startswith("-----BEGIN PUBLIC KEY-----") + parsed = sdk_rsa.PublicKey.load_pkcs1_openssl_pem(public_key) + assert parsed.n == private_key.public_key().public_numbers().n + + def test_certificate_bundle_keeps_valid_certificates_when_one_block_is_unsupported(monkeypatch, tmp_path): bundle = tmp_path / "alipayRootCert.crt" bundle.write_bytes(