-
-
Notifications
You must be signed in to change notification settings - Fork 9.1k
修复公钥模式下平台证书自动更新导致的初始化失败问题 #3854
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 2 commits
0b3ec25
0b3c45a
77134da
1b3ec31
546310b
43c69b1
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| package com.github.binarywang.wxpay.v3.auth; | ||
|
|
||
| import com.github.binarywang.wxpay.config.WxPayHttpProxy; | ||
|
binarywang marked this conversation as resolved.
Outdated
|
||
| import org.testng.annotations.Test; | ||
|
|
||
| import java.nio.charset.StandardCharsets; | ||
| import java.security.cert.X509Certificate; | ||
|
|
||
| import static org.testng.Assert.*; | ||
|
|
||
| /** | ||
| * 测试公钥模式下 AutoUpdateCertificatesVerifier 的健壮性 | ||
| * | ||
| * @author copilot | ||
| */ | ||
| public class AutoUpdateCertificatesVerifierPublicKeyModeTest { | ||
|
|
||
| /** | ||
| * 测试当证书下载失败时,构造函数不应该抛出异常 | ||
| * 这是为了支持公钥模式下的场景,在公钥模式下商户可能没有平台证书 | ||
| */ | ||
| @Test | ||
| public void testConstructorShouldNotThrowExceptionWhenCertDownloadFails() { | ||
| // 使用一个无效的配置,模拟证书下载失败的场景 | ||
| String invalidMchId = "invalid_mch_id"; | ||
| String invalidApiV3Key = "invalid_api_v3_key_must_be_32_b"; | ||
| String invalidCertSerialNo = "invalid_serial_no"; | ||
| String payBaseUrl = "https://api.mch.weixin.qq.com"; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. |
||
|
|
||
| WxPayCredentials credentials = new WxPayCredentials( | ||
| invalidMchId, | ||
| new PrivateKeySigner(invalidCertSerialNo, null) | ||
|
||
| ); | ||
|
|
||
| // 构造函数应该不抛出异常,即使证书下载失败 | ||
| AutoUpdateCertificatesVerifier verifier = null; | ||
| try { | ||
| verifier = new AutoUpdateCertificatesVerifier( | ||
| credentials, | ||
| invalidApiV3Key.getBytes(StandardCharsets.UTF_8), | ||
| 60, | ||
| payBaseUrl, | ||
| null | ||
| ); | ||
| // 如果没有抛出异常,测试通过 | ||
| assertNotNull(verifier); | ||
| } catch (Exception e) { | ||
| fail("构造函数不应该抛出异常,但抛出了: " + e.getMessage()); | ||
| } | ||
|
binarywang marked this conversation as resolved.
Outdated
|
||
| } | ||
|
|
||
| /** | ||
| * 测试当没有有效证书时,verify 方法应该返回 false 而不是抛出异常 | ||
| */ | ||
| @Test | ||
| public void testVerifyShouldReturnFalseWhenNoCertificateAvailable() { | ||
| String invalidMchId = "invalid_mch_id"; | ||
| String invalidApiV3Key = "invalid_api_v3_key_must_be_32_b"; | ||
| String invalidCertSerialNo = "invalid_serial_no"; | ||
| String payBaseUrl = "https://api.mch.weixin.qq.com"; | ||
|
|
||
| WxPayCredentials credentials = new WxPayCredentials( | ||
| invalidMchId, | ||
| new PrivateKeySigner(invalidCertSerialNo, null) | ||
| ); | ||
|
|
||
| AutoUpdateCertificatesVerifier verifier = new AutoUpdateCertificatesVerifier( | ||
| credentials, | ||
| invalidApiV3Key.getBytes(StandardCharsets.UTF_8), | ||
| 60, | ||
| payBaseUrl, | ||
| null | ||
| ); | ||
|
|
||
| // verify 方法应该返回 false,而不是抛出异常 | ||
| boolean result = verifier.verify("test_serial", "test_message".getBytes(), "test_signature"); | ||
| assertFalse(result, "当没有有效证书时,verify 应该返回 false"); | ||
| } | ||
|
|
||
| /** | ||
| * 测试当没有有效证书时,getValidCertificate 方法应该抛出有意义的异常 | ||
| */ | ||
| @Test(expectedExceptions = me.chanjar.weixin.common.error.WxRuntimeException.class, | ||
| expectedExceptionsMessageRegExp = ".*No valid certificate available.*") | ||
| public void testGetValidCertificateShouldThrowMeaningfulException() { | ||
| String invalidMchId = "invalid_mch_id"; | ||
| String invalidApiV3Key = "invalid_api_v3_key_must_be_32_b"; | ||
| String invalidCertSerialNo = "invalid_serial_no"; | ||
| String payBaseUrl = "https://api.mch.weixin.qq.com"; | ||
|
|
||
| WxPayCredentials credentials = new WxPayCredentials( | ||
| invalidMchId, | ||
| new PrivateKeySigner(invalidCertSerialNo, null) | ||
| ); | ||
|
|
||
| AutoUpdateCertificatesVerifier verifier = new AutoUpdateCertificatesVerifier( | ||
| credentials, | ||
| invalidApiV3Key.getBytes(StandardCharsets.UTF_8), | ||
| 60, | ||
| payBaseUrl, | ||
| null | ||
| ); | ||
|
Comment on lines
+60
to
+86
|
||
|
|
||
| // 应该抛出有意义的异常 | ||
| X509Certificate certificate = verifier.getValidCertificate(); | ||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
这里的容错只捕获了
IOException | GeneralSecurityException,但autoUpdateCert()在 HTTP 非 200(以及签名等运行时失败)时会直接抛WxRuntimeException,仍可能导致初始化阶段异常退出(与 PR 目标的 404 场景不一致)。建议确认是否需要把该运行时异常也纳入容错范围。🤖 Was this useful? React with 👍 or 👎