From b724381de526c5519b93c92f7d2e61e9ab290972 Mon Sep 17 00:00:00 2001 From: vincent Date: Fri, 23 Oct 2026 17:12:59 +0800 Subject: [PATCH] =?UTF-8?q?=E5=9B=9E=E9=80=80=E4=BA=86=E7=99=BB=E5=BD=95?= =?UTF-8?q?=E5=8A=A0=E5=AF=86=E5=8A=9F=E8=83=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../enforcement/AppEnfLoginController.java | 6 +++- .../system/CryptoSensitiveController.java | 33 +++++++++++++++++++ .../service/impl/PasswordAuthStrategy.java | 10 +++--- 3 files changed, 43 insertions(+), 6 deletions(-) diff --git a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/enforcement/AppEnfLoginController.java b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/enforcement/AppEnfLoginController.java index 90b7f202..1fea6e4c 100644 --- a/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/enforcement/AppEnfLoginController.java +++ b/zdxt-modules/zdxt-enforcement-code/src/main/java/com/zdxt/enforcementcode/controller/app/enforcement/AppEnfLoginController.java @@ -89,7 +89,11 @@ public class AppEnfLoginController extends LoginController { } // 5. MD5加盐校验密码（使用loginName作为加盐因子） - if (!verifyPasswordWithHsm(user.getUserId(), loginName, decryptedPassword, user.getSalt(), user.getPassword())) { +// if (!verifyPasswordWithHsm(user.getUserId(), loginName, decryptedPassword, user.getSalt(), user.getPassword())) { +// return R.fail("用户名或密码错误"); +// } + + if (!verifyPassword(loginName, decryptedPassword, user.getSalt(), user.getPassword())) { return R.fail("用户名或密码错误"); } diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/CryptoSensitiveController.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/CryptoSensitiveController.java index 0e36a5ac..ba70ed93 100644 --- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/CryptoSensitiveController.java +++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/CryptoSensitiveController.java @@ -54,4 +54,37 @@ public class CryptoSensitiveController extends BaseController { cryptoSensitiveHsmService.syncIntegrityHashModifiedOperLogs(); return R.ok(); } + + /** + * 测试 HSM 解密逻辑：解密 crypto_sensitive_data 中指定记录的密文字段 + * + * @param tableName 业务表名，为空默认 sys_user + * @param bizId 业务记录主键（sys_user 时为用户ID），必填 + * @param fieldCode 字段编码，为空默认 phonenumber（可选 phonenumber / certificateNumber 等） + */ + @PostMapping("/testDecrypt") + public R testDecrypt(String tableName, String bizId, String fieldCode) { + if (bizId == null || bizId.isBlank()) { + return R.fail("bizId 不能为空"); + } + if (tableName == null || tableName.isBlank()) { + tableName = "sys_user"; + } + if (fieldCode == null || fieldCode.isBlank()) { + fieldCode = "phonenumber"; + } + long start = System.currentTimeMillis(); + String plain = cryptoSensitiveHsmService.decryptField(tableName, bizId, fieldCode); + long cost = System.currentTimeMillis() - start; + // 按规范：HSM 解密失败返回 null（禁止返回空串） + if (plain == null) { + log.warn("测试解密失败: tableName={}, bizId={}, fieldCode={}, cost={}ms", + tableName, bizId, fieldCode, cost); + return R.fail("解密失败或密文记录不存在(HSM返回null)，tableName=%s, bizId=%s, fieldCode=%s" + .formatted(tableName, bizId, fieldCode)); + } + log.info("测试解密成功: tableName={}, bizId={}, fieldCode={}, cost={}ms", + tableName, bizId, fieldCode, cost); + return R.ok("解密成功，耗时" + cost + "ms", plain); + } } diff --git a/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/service/impl/PasswordAuthStrategy.java b/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/service/impl/PasswordAuthStrategy.java index f769ff01..d8b9a4ef 100644 --- a/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/service/impl/PasswordAuthStrategy.java +++ b/zdxt-web-server/zdxt-admin-web-server/src/main/java/org/dromara/web/service/impl/PasswordAuthStrategy.java @@ -48,7 +48,7 @@ public class PasswordAuthStrategy implements IAuthStrategy { private final SysLoginService loginService; private final SysUserMapper userMapper; private final PasswordService passwordService; - private final ICryptoSensitiveHsmService ICryptoSensitiveHsmService; + private final ICryptoSensitiveHsmService iCryptoSensitiveHsmService; @Override public LoginVo login(String body, SysClientVo client) { @@ -68,14 +68,14 @@ public class PasswordAuthStrategy implements IAuthStrategy { SysUser user = loadUserByUsername(username); loginService.checkLogin(LoginType.PASSWORD, tenantId, username, () -> { String bizId = String.valueOf(user.getUserId()); - try { - return !ICryptoSensitiveHsmService.verifyPassword("sys_user", bizId, password); - } catch (Exception e) { +// try { +// return !ICryptoSensitiveHsmService.verifyPassword("sys_user", bizId, password); +// } catch (Exception e) { log.warn("HSM密码校验失败, userId={}, 降级使用MD5校验", user.getUserId()); String salt = user.getSalt(); String encodedPassword = user.getPassword(); return !passwordService.matches(password, encodedPassword, username, salt); - } +// } }); return loginService.buildLoginUser(user); });