From 9ab08254e3b3bbc747917180fe8d9731bda57ac7 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@aicrm.local>
Date: Mon, 14 Sep 2026 15:50:49 +0800
Subject: [PATCH] =?UTF-8?q?security:=20=E5=BE=AE=E4=BF=A1=E5=9B=9E?=
 =?UTF-8?q?=E8=B0=83POST=E9=AA=8C=E7=AD=BE=E2=80=94=E2=80=94=E6=98=8E?=
 =?UTF-8?q?=E6=96=87=E6=A8=A1=E5=BC=8Fsignature=E6=A0=A1=E9=AA=8C=E9=98=B2?=
 =?UTF-8?q?=E4=BC=AA=E9=80=A0=E6=94=AF=E4=BB=98=E5=9B=9E=E8=B0=83=E7=99=BD?=
 =?UTF-8?q?=E6=8B=BF=E6=98=9F=E5=B0=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/src/routes/wxmsg.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server/src/routes/wxmsg.js b/server/src/routes/wxmsg.js
index 9cbadcf..d862e84 100644
--- a/server/src/routes/wxmsg.js
+++ b/server/src/routes/wxmsg.js
@@ -38,6 +38,11 @@ module.exports = function registerWxMsgRoutes(app) {
 
   app.post('/api/wx/msg', async (req, res) => {
     try {
+      // 验签：明文模式下 POST 同样携带 signature/timestamp/nonce，防止伪造支付回调
+      const { signature, timestamp, nonce } = req.query || {}
+      if (!verifySignature(timestamp, nonce, signature)) {
+        return res.status(403).send('forbidden')
+      }
       // 数据格式推荐 JSON：express.json 已解析为对象；选 XML 时是字符串
       let fields = {}
       if (req.body && typeof req.body === 'object') {