xiaokang/lotteryLaravel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(core): harden settlement and wallet integration

Browse Source
This commit is contained in:
wchino
2026-07-22 01:40:37 +08:00
parent 150c3e7ebd
commit 35f6e46958
54 changed files with 2564 additions and 359 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
app/Support/Integration/GuardedWalletApiEndpoint.php Normal file
View File

@@ -0,0 +1,43 @@
<?php
namespace App\Support\Integration;
use Illuminate\Support\Facades\Http;
use Illuminate\Http\Client\PendingRequest;
final readonly class GuardedWalletApiEndpoint
{
public function __construct(
public string $baseUrl,
public string $hostname,
public int $port,
public string $pinnedIp,
public int $totalTimeoutSeconds,
public int $connectTimeoutSeconds,
) {}
/** @param array<string, string> $headers */
public function request(array $headers = []): PendingRequest
{
$pending = Http::withHeaders($headers)
->withoutRedirecting()
->connectTimeout($this->connectTimeoutSeconds)
->timeout($this->totalTimeoutSeconds)
// A proxy would resolve the hostname independently and defeat DNS pinning.
->withOptions(['proxy' => '']);
if (filter_var($this->hostname, FILTER_VALIDATE_IP) === false) {
$address = filter_var($this->pinnedIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)
? '['.$this->pinnedIp.']'
: $this->pinnedIp;
$pending->withOptions([
'curl' => [
CURLOPT_RESOLVE => [$this->hostname.':'.$this->port.':'.$address],
],
]);
}
return $pending;
}
}

31
app/Support/Integration/SystemWalletApiDnsResolver.php Normal file
View File

@@ -0,0 +1,31 @@
<?php
namespace App\Support\Integration;
use App\Contracts\WalletApiDnsResolver;
final class SystemWalletApiDnsResolver implements WalletApiDnsResolver
{
public function resolveAll(string $hostname): array
{
$records = dns_get_record($hostname, DNS_A | DNS_AAAA);
if (! is_array($records)) {
return [];
}
$addresses = [];
foreach ($records as $record) {
$address = match ($record['type'] ?? null) {
'A' => $record['ip'] ?? null,
'AAAA' => $record['ipv6'] ?? null,
default => null,
};
if (is_string($address) && $address !== '') {
$addresses[] = $address;
}
}
return array_values(array_unique($addresses));
}
}

74
app/Support/Integration/WalletApiRequestGuard.php Normal file
View File

@@ -0,0 +1,74 @@
<?php
namespace App\Support\Integration;
use App\Contracts\WalletApiDnsResolver;
final readonly class WalletApiRequestGuard
{
private const MAX_CONNECT_TIMEOUT_SECONDS = 5;
public function __construct(
private WalletApiDnsResolver $dnsResolver,
) {}
public function guard(?string $rawBaseUrl, int $timeoutSeconds): ?GuardedWalletApiEndpoint
{
$baseUrl = WalletApiUrlSanitizer::normalizeAndValidate($rawBaseUrl);
if ($baseUrl === null) {
return null;
}
$parts = parse_url($baseUrl);
if (! is_array($parts) || ! is_string($parts['host'] ?? null)) {
return null;
}
$hostname = trim((string) $parts['host'], '[]');
$port = isset($parts['port']) ? (int) $parts['port'] : 443;
if (filter_var($hostname, FILTER_VALIDATE_IP) !== false) {
$addresses = [$hostname];
} else {
// Pinning is required for hostnames; without cURL, a second DNS lookup could rebind.
if (! extension_loaded('curl')
|| ! defined('CURLOPT_RESOLVE')
|| (! function_exists('curl_exec') && ! function_exists('curl_multi_exec'))
) {
return null;
}
try {
$addresses = $this->dnsResolver->resolveAll($hostname);
} catch (\Throwable) {
return null;
}
}
$addresses = array_values(array_unique(array_filter(
$addresses,
static fn (mixed $address): bool => is_string($address) && $address !== '',
)));
if ($addresses === []) {
return null;
}
foreach ($addresses as $address) {
if (! WalletApiUrlSanitizer::isPublicIp($address)) {
return null;
}
}
$totalTimeoutSeconds = max(1, $timeoutSeconds);
return new GuardedWalletApiEndpoint(
baseUrl: $baseUrl,
hostname: $hostname,
port: $port,
pinnedIp: $addresses[0],
totalTimeoutSeconds: $totalTimeoutSeconds,
connectTimeoutSeconds: min(self::MAX_CONNECT_TIMEOUT_SECONDS, $totalTimeoutSeconds),
);
}
}

85
app/Support/Integration/WalletApiUrlSanitizer.php
View File

@@ -11,7 +11,7 @@ namespace App\Support\Integration;
* - 不允许除 / 以外的 path（即仅允许根地址）
* - 拒绝 localhost 与私网/保留网段（IP 字面量层面）
*
* 说明：对 hostname 不做 DNS 解析（避免引入不确定性），但会拦截 localhost 及明显内网标识。
* hostname 的 DNS 解析与请求时固定解析由 WalletApiRequestGuard 负责。
*/
final class WalletApiUrlSanitizer
{
@@ -26,13 +26,6 @@ final class WalletApiUrlSanitizer
return null;
}
// E2E：允许本地 mock 主站钱包（http://127.0.0.1:port），生产 LOTTERY_E2E 默认 false。
if ((bool) env('LOTTERY_E2E', false) && app()->environment(['local', 'testing'])) {
if (preg_match('#^https?://127\.0\.0\.1:\d{1,5}$#', rtrim($raw, '/')) === 1) {
return rtrim($raw, '/');
}
}
// 允许尾部 /，归一化后移除
$raw = rtrim($raw, " \t\n\r\0\x0B/");
@@ -68,6 +61,8 @@ final class WalletApiUrlSanitizer
return null;
}
$host = trim($host, '[]');
// 明确拦截 localhost / 本地常见名
if ($host === 'localhost' || $host === 'local' || $host === 'localdomain') {
return null;
@@ -76,7 +71,16 @@ final class WalletApiUrlSanitizer
// 拦截 IP 字面量私网
$isIp = filter_var($host, FILTER_VALIDATE_IP) !== false;
if ($isIp) {
if (self::ipIsPrivateOrReserved($host)) {
if (! self::isPublicIp($host)) {
return null;
}
} else {
$host = rtrim($host, '.');
if (! str_contains($host, '.')
|| preg_match('/^[0-9.]+$/D', $host) === 1
|| preg_match('/(^|\.)(?:0x[0-9a-f]+|0[0-7]+)(?:\.|$)/iD', $host) === 1
|| filter_var($host, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) === false
) {
return null;
}
}
@@ -89,7 +93,10 @@ final class WalletApiUrlSanitizer
}
}
$normalized = 'https://'.$host;
$normalizedHost = filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)
? '['.$host.']'
: $host;
$normalized = 'https://'.$normalizedHost;
if (isset($parts['port'])) {
$normalized .= ':'.(string) (int) $parts['port'];
}
@@ -97,18 +104,26 @@ final class WalletApiUrlSanitizer
return $normalized;
}
private static function ipIsPrivateOrReserved(string $ip): bool
public static function isPublicIp(string $ip): bool
{
if (filter_var(
$ip,
FILTER_VALIDATE_IP,
FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE,
) === false) {
return false;
}
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
$v = ip2long($ip);
if ($v === false) {
return true;
return false;
}
// PHP 在 macOS 上 ip2long 可能为有符号，强转为 int64 统一处理
$v = (int) $v;
return self::ipInRangesV4((int) $v, [
return ! self::ipInRangesV4((int) $v, [
// 0.0.0.0/8
['base' => ip2long('0.0.0.0'), 'mask' => 0xFF000000],
// 10.0.0.0/8
@@ -125,6 +140,11 @@ final class WalletApiUrlSanitizer
['base' => ip2long('100.64.0.0'), 'mask' => 0xFFC00000],
// 192.0.0.0/24 (IETF Protocol Assignments)
['base' => ip2long('192.0.0.0'), 'mask' => 0xFFFFFF00],
// Documentation and deprecated relay ranges
['base' => ip2long('192.0.2.0'), 'mask' => 0xFFFFFF00],
['base' => ip2long('192.88.99.0'), 'mask' => 0xFFFFFF00],
['base' => ip2long('198.51.100.0'), 'mask' => 0xFFFFFF00],
['base' => ip2long('203.0.113.0'), 'mask' => 0xFFFFFF00],
// 198.18.0.0/15 (benchmarking)
['base' => ip2long('198.18.0.0'), 'mask' => 0xFFFE0000],
// 224.0.0.0/4 (multicast)
@@ -138,17 +158,17 @@ final class WalletApiUrlSanitizer
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
$bin = inet_pton($ip);
if ($bin === false) {
return true;
return false;
}
// IPv6 ::1 (loopback)
if (substr($bin, 0, 15) === str_repeat("\0", 15) && $bin[15] === "\1") {
return true;
return false;
}
// IPv6 unspecified ::
if ($bin === str_repeat("\0", 16)) {
return true;
return false;
}
$b0 = ord($bin[0]);
@@ -156,34 +176,52 @@ final class WalletApiUrlSanitizer
// ff00::/8 multicast
if ($b0 === 0xFF) {
return true;
return false;
}
// fc00::/7 unique local => fc or fd
if ($b0 === 0xFC || $b0 === 0xFD) {
return true;
return false;
}
// fe80::/10 link-local => fe + (second byte & 0xC0) == 0x80
if ($b0 === 0xFE && (($b1 & 0xC0) === 0x80)) {
return true;
return false;
}
// IPv4-mapped ::ffff:0:0/96 => 检查最后 4 字节映射的 IPv4 是否为私网
if (substr($bin, 0, 10) === str_repeat("\0", 10) && substr($bin, 10, 2) === "\xFF\xFF") {
$v4bin = substr($bin, 12, 4);
$v4 = inet_ntop($v4bin);
// inet_ntop 对 v4bin 有时返回 false，这里保守返回 true
// inet_ntop 对 v4bin 有时返回 false，这里保守拒绝
if ($v4 === false) {
return true;
return false;
}
return self::ipIsPrivateOrReserved($v4);
return self::isPublicIp($v4);
}
// IPv4 translation prefixes can otherwise tunnel a private IPv4 target.
$isIpv4Translation = substr($bin, 0, 12) === "\x00\x64\xFF\x9B\x00\x00\x00\x00\x00\x00\x00\x00"
|| substr($bin, 0, 6) === "\x00\x64\xFF\x9B\x00\x01";
// 100::/64 discard-only, 2001::/23 protocol assignments,
// 2001:db8::/32 and 3fff::/20 documentation, 2002::/16 deprecated 6to4.
if ($isIpv4Translation
|| substr($bin, 0, 8) === "\x00\x64\x00\x00\x00\x00\x00\x00"
|| ($b0 === 0x20 && $b1 === 0x01 && (ord($bin[2]) & 0xFE) === 0)
|| substr($bin, 0, 4) === "\x20\x01\x0D\xB8"
|| ($b0 === 0x3F && ($b1 & 0xF0) === 0xF0)
|| ($b0 === 0x20 && $b1 === 0x02)
) {
return false;
}
return true;
}
// 非法 IP：保守拒绝
return true;
return false;
}
private static function ipInRangesV4(int $v, array $ranges): bool
@@ -199,4 +237,3 @@ final class WalletApiUrlSanitizer
return false;
}
}