honest.tai
d1aac6b989
fix(payment): close EasyPay forged-callback sign reuse ( fixes #7881 )
...
An order-creation signature (visible to the payer in popup submit.php
URLs) could be replayed as a payment-success notification, with no
merchant key required. Two compounding defects:
- CanonicalizeReturnURL kept client-supplied query parameters, so a
return_url ending in '&trade_status=TRADE_SUCCESS' entered the signed
order string verbatim;
- the sign base string concatenates values unescaped, so a callback that
decodes return_url only up to the smuggled pair re-sorts to a
byte-identical sign base and passes verification.
Fixes:
- CanonicalizeReturnURL now drops client query parameters entirely; the
server builds its own signed set and the client query has no
legitimate use;
- VerifyNotification rejects any parameter outside the genuine async
notify set (pid/trade_no/out_trade_no/type/name/money/trade_status/
param/sign/sign_type), failing closed against the whole smuggling
class regardless of the injection point.
Regression tests cover the PoC payload, full order-URL replay, genuine
callback acceptance, unknown-parameter rejection (including empty
values), and the return_url smuggling strip. Genuinely paid orders that
an exotic upstream variant might reject are still recovered through the
existing upstream QueryOrder reconcile path.
2026-10-06 23:14:56 +08:00
..
2026-09-27 14:56:38 +08:00
2026-09-27 14:56:38 +08:00
2026-09-20 20:20:16 +08:00
2026-09-27 12:12:25 +08:00
2026-09-27 12:12:25 +08:00
2026-09-23 01:43:06 +08:00
2026-09-23 13:35:44 +08:00
2026-10-02 13:08:40 +08:00
2026-10-02 13:08:40 +08:00
2026-10-02 13:08:40 +08:00
2026-09-28 14:48:42 +08:00
2026-09-20 15:47:53 +08:00
2026-09-28 14:48:42 +08:00
2026-10-02 13:51:58 +08:00
2026-09-23 15:26:35 +08:00
2026-10-02 09:37:30 +08:00
2026-10-02 13:51:58 +08:00
2026-09-25 09:12:09 +08:00
2026-09-23 01:24:59 +08:00
2026-09-23 01:24:59 +08:00
2026-09-23 15:27:53 +08:00
2026-09-26 17:13:10 +08:00
2026-09-28 12:15:27 +08:00
2026-09-28 12:15:27 +08:00
2026-09-26 17:13:10 +08:00
2026-09-28 12:23:13 -04:00
2026-09-21 20:13:44 +08:00
2026-09-26 17:13:10 +08:00
2026-09-21 20:13:44 +08:00
2026-09-21 20:13:44 +08:00
2026-09-28 12:23:13 -04:00
2026-09-28 12:23:13 -04:00
2026-09-30 13:44:02 +08:00
2026-09-30 13:44:02 +08:00
2026-09-30 13:44:02 +08:00
2026-09-30 13:44:02 +08:00
2026-09-30 13:44:02 +08:00
2026-09-30 13:44:02 +08:00
2026-09-28 12:26:28 -04:00
2026-09-28 12:26:28 -04:00
2026-09-18 06:56:27 +08:00
2026-09-18 06:56:27 +08:00
2026-09-23 00:44:29 +08:00
2026-09-18 06:56:27 +08:00
2026-09-23 11:18:08 +08:00
2026-09-23 11:18:08 +08:00
2026-09-29 04:55:07 +08:00
2026-09-29 04:55:07 +08:00
2026-09-23 08:17:48 +08:00
2026-09-23 08:17:48 +08:00
2026-09-28 17:08:27 -04:00
2026-09-28 17:08:13 -04:00
2026-10-02 09:37:30 +08:00
2026-10-02 09:37:30 +08:00
2026-09-20 16:41:49 +08:00
2026-09-20 16:41:49 +08:00
2026-09-20 16:41:49 +08:00
2026-09-20 20:20:16 +08:00
2026-10-02 09:37:30 +08:00
2026-09-20 16:41:49 +08:00
2026-09-20 16:41:49 +08:00
2026-09-23 14:39:29 +08:00
2026-09-23 14:39:29 +08:00
2026-09-28 20:59:39 -04:00
2026-09-29 11:41:33 -04:00
2026-09-29 14:21:10 -04:00
2026-09-29 14:21:10 -04:00
2026-09-26 17:13:10 +08:00
2026-09-17 01:22:22 +08:00
2026-09-20 20:20:16 +08:00
2026-09-20 20:20:16 +08:00
2026-09-19 20:52:31 -04:00
2026-09-19 20:52:31 -04:00
2026-09-22 19:07:04 +08:00
2026-10-02 13:51:58 +08:00
2026-09-18 14:54:18 +08:00
2026-10-02 13:51:58 +08:00
2026-09-19 20:52:31 -04:00
2026-09-19 20:52:31 -04:00
2026-10-02 09:37:30 +08:00
2026-09-29 01:50:21 +08:00
2026-09-29 01:50:21 +08:00
2026-09-28 14:48:42 +08:00
2026-10-02 09:37:30 +08:00
2026-09-28 12:26:28 -04:00
2026-09-28 12:26:28 -04:00
2026-09-29 05:20:04 +08:00
2026-09-29 04:55:07 +08:00
2026-09-29 04:55:07 +08:00
2026-09-23 13:35:44 +08:00
2026-09-23 13:35:44 +08:00
2026-09-29 04:55:07 +08:00
2026-09-23 13:35:44 +08:00
2026-09-20 16:41:49 +08:00
2026-09-29 04:55:07 +08:00
2026-09-21 12:58:56 +08:00
2026-09-29 15:44:10 +08:00
2026-09-29 15:44:10 +08:00
2026-09-29 15:44:10 +08:00
2026-09-29 04:55:07 +08:00
2026-09-23 11:51:06 +08:00
2026-09-21 19:58:02 +08:00
2026-09-22 16:54:36 +08:00
2026-09-20 16:41:49 +08:00
2026-09-29 04:55:07 +08:00
2026-09-29 05:20:04 +08:00
2026-09-22 16:54:36 +08:00
2026-09-23 11:51:06 +08:00
2026-09-23 08:17:48 +08:00
2026-09-29 04:55:07 +08:00
2026-09-28 10:10:47 +08:00
2026-10-02 13:51:58 +08:00
2026-10-02 13:51:58 +08:00
2026-09-20 11:02:06 +08:00
2026-09-29 15:00:16 +08:00
2026-09-29 15:00:16 +08:00
2026-09-29 04:55:07 +08:00
2026-09-23 15:26:35 +08:00
2026-09-26 17:13:10 +08:00
2026-09-23 08:17:48 +08:00
2026-09-28 16:14:43 -04:00
2026-09-22 18:12:19 +08:00
2026-09-22 11:31:31 +08:00
2026-09-22 11:31:31 +08:00
2026-09-22 20:30:37 +08:00
2026-09-21 19:58:02 +08:00
2026-09-21 19:58:02 +08:00
2026-09-20 15:04:15 +08:00
2026-09-17 19:41:55 +08:00
2026-09-21 14:13:57 +08:00
2026-09-26 17:13:10 +08:00
2026-09-17 04:14:14 +09:00
2026-10-01 12:17:27 +08:00
2026-10-01 12:17:27 +08:00
2026-10-01 12:17:27 +08:00
2026-09-25 09:12:09 +08:00
2026-09-28 10:49:01 +08:00
2026-09-23 13:35:44 +08:00
2026-09-23 13:35:44 +08:00
2026-09-23 11:28:41 +08:00
2026-09-23 11:28:41 +08:00
2026-09-24 15:46:14 +08:00
2026-09-24 15:46:14 +08:00
2026-09-18 23:51:08 +08:00
2026-09-23 15:26:35 +08:00
2026-09-23 12:01:40 +08:00
2026-09-29 15:43:52 +08:00
2026-09-23 15:29:11 +08:00
2026-09-24 15:54:15 +08:00
2026-09-24 15:54:15 +08:00
2026-09-24 15:54:15 +08:00
2026-09-24 15:50:00 +08:00
2026-09-24 15:50:00 +08:00
2026-09-17 19:15:09 +08:00
2026-09-16 16:11:43 +08:00
2026-09-16 16:11:43 +08:00
2026-09-20 19:27:47 +08:00
2026-09-20 19:27:47 +08:00
2026-09-22 14:50:29 +08:00
2026-09-29 11:50:08 -07:00
2026-09-29 11:50:08 -07:00
2026-09-29 11:49:26 -07:00
2026-09-29 11:50:08 -07:00
2026-09-29 11:49:26 -07:00
2026-09-20 19:27:47 +08:00
2026-09-20 19:27:47 +08:00
2026-09-19 10:36:51 +08:00
2026-09-23 16:48:15 +08:00
2026-09-29 11:49:26 -07:00
2026-09-29 11:49:26 -07:00
2026-09-29 11:49:26 -07:00
2026-09-21 12:58:56 +08:00
2026-09-22 15:51:51 +08:00
2026-09-29 15:44:10 +08:00
2026-09-20 16:41:49 +08:00
2026-09-29 11:49:26 -07:00
2026-09-29 11:49:26 -07:00
2026-09-29 11:49:26 -07:00
2026-09-23 15:27:53 +08:00
2026-09-21 19:58:02 +08:00
2026-09-23 18:32:49 -04:00
2026-09-19 14:55:02 +09:00
2026-09-27 09:57:51 +08:00
2026-09-22 10:30:01 +08:00
2026-10-01 12:17:27 +08:00
2026-09-29 04:55:07 +08:00
2026-09-23 16:48:15 +08:00
2026-09-29 11:49:26 -07:00
2026-09-29 11:49:26 -07:00
2026-09-22 22:00:51 +08:00
2026-09-26 20:11:03 +09:00
2026-09-29 11:49:26 -07:00
2026-09-23 10:03:00 +08:00
2026-09-29 15:44:10 +08:00
2026-09-29 11:49:26 -07:00
2026-09-29 15:43:52 +08:00
2026-09-20 16:41:49 +08:00
2026-09-27 09:57:51 +08:00
2026-09-27 09:57:51 +08:00
2026-09-28 09:55:19 +08:00
2026-09-21 10:23:10 +08:00
2026-09-21 10:23:10 +08:00
2026-09-29 15:00:16 +08:00
2026-09-23 10:07:02 +08:00
2026-09-20 19:28:13 +08:00
2026-09-29 11:49:26 -07:00
2026-09-22 15:51:51 +08:00
2026-09-22 15:51:51 +08:00
2026-09-23 11:27:49 +08:00
2026-09-20 11:26:19 +08:00
2026-09-20 11:26:19 +08:00
2026-09-25 12:17:11 +08:00
2026-09-25 12:17:11 +08:00
2026-09-20 15:47:53 +08:00
2026-09-20 15:47:53 +08:00
2026-09-20 15:47:53 +08:00
2026-09-20 15:47:53 +08:00
2026-09-20 15:47:53 +08:00
2026-09-20 15:47:53 +08:00
2026-09-20 15:47:53 +08:00
2026-09-18 13:31:58 +08:00
2026-09-22 19:47:12 +08:00
2026-09-22 19:47:12 +08:00
2026-09-22 20:49:24 +08:00
2026-09-22 20:49:24 +08:00
2026-09-26 17:13:10 +08:00
2026-09-17 19:15:09 +08:00
2026-09-20 16:37:07 +08:00
2026-09-26 07:45:10 -04:00
2026-09-29 15:43:52 +08:00
2026-09-26 07:45:10 -04:00
2026-09-17 19:15:09 +08:00
2026-09-22 22:00:51 +08:00
2026-09-23 15:26:44 +08:00
2026-09-23 15:26:44 +08:00
2026-09-23 15:26:44 +08:00
2026-09-23 15:26:44 +08:00
2026-10-02 00:25:41 +08:00
2026-09-23 01:24:59 +08:00
2026-10-02 00:25:41 +08:00
2026-10-02 00:25:41 +08:00
2026-10-02 00:25:41 +08:00
2026-10-02 00:25:41 +08:00
2026-10-02 00:25:41 +08:00
2026-10-06 23:14:56 +08:00
2026-10-06 23:14:56 +08:00
2026-10-02 00:25:41 +08:00
2026-09-20 11:26:19 +08:00
2026-09-20 11:26:19 +08:00
2026-09-20 11:26:19 +08:00
2026-09-19 11:25:56 +08:00
2026-09-20 11:26:19 +08:00
2026-09-19 11:25:56 +08:00
2026-09-19 11:25:56 +08:00
2026-09-29 11:49:26 -07:00
2026-09-19 00:51:01 +08:00
2026-09-19 00:51:01 +08:00
2026-09-19 00:00:57 +08:00
2026-09-23 10:05:42 +08:00
2026-09-22 15:51:51 +08:00
2026-09-19 00:00:57 +08:00
2026-09-23 10:05:42 +08:00
2026-09-20 16:41:49 +08:00
2026-09-22 18:11:46 +08:00
2026-09-22 15:03:05 +08:00
2026-09-22 15:03:06 +08:00
2026-09-29 01:50:21 +08:00
2026-09-20 20:20:16 +08:00
2026-09-17 04:14:14 +09:00
2026-09-17 17:51:03 +09:00
2026-09-29 11:50:08 -07:00
2026-09-29 11:50:08 -07:00
2026-09-23 14:39:29 +08:00
2026-09-29 01:50:21 +08:00
2026-09-29 01:50:21 +08:00
2026-09-29 01:50:21 +08:00
2026-09-29 01:50:21 +08:00
2026-09-29 01:50:21 +08:00
2026-09-29 01:50:21 +08:00
2026-09-15 10:00:26 -04:00
2026-10-02 10:48:37 +00:00
2026-10-02 10:45:53 +00:00
2026-10-01 12:17:27 +08:00
2026-09-23 13:35:44 +08:00
2026-09-22 10:30:01 +08:00
2026-09-28 12:26:28 -04:00
2026-09-29 11:41:33 -04:00