[Auto CQUPT Plan] CAS 统一认证登录逆向（补档）

1
func (r *HttpSpyderCore) GetGlobalCookie() error {
2
    finalURL := fmt.Sprintf("%s?service=%s", r.baseUrl, r.targetService)
3

4
    req, err := http.NewRequest("GET", finalURL, nil)
5
    if err != nil {
6
        return err
7
    }
8
    for key, val := range r.headers {
9
        req.Header.Set(key, val)
10
    }
11

12
    resp, err := r.client.Do(req)
13
    if err != nil {
14
        return err
15
    }
16

17
    r.mergeCookiesFromResponse(resp)
18
    _ = resp.Body.Close()
19
    return nil
20
}

1
func (r *HttpSpyderCore) GetBasicData() (*BasicData, error) {
2
    data := &BasicData{}
3
    finalURL := fmt.Sprintf("%s?service=%s", r.baseUrl, r.targetService)
4

5
    req, err := http.NewRequest("GET", finalURL, nil)
6
    if err != nil {
7
        return nil, err
8
    }
9
    for key, val := range r.headers {
10
        req.Header.Set(key, val)
11
    }
12

13
    resp, err := r.client.Do(req)
14
    if err != nil {
15
        return nil, err
16
    }
17
    r.mergeCookiesFromResponse(resp)
18

19
    bodyBytes, err := io.ReadAll(resp.Body)
20
    if err != nil {
21
        return nil, err
22
    }
23

24
    data.Execution = extractor.ExtractInputValue(bodyBytes, `id="execution"`, `name="execution"`)
25
    data.PwdEncryptSalt = extractor.ExtractInputValue(bodyBytes, `id="pwdEncryptSalt"`)
26
    data.FormAction = extractor.ExtractAnyFormAction(bodyBytes, "pwdFromId", "casLoginForm")
27

28
    if data.FormAction != "" {
29
        r.postURL = r.resolveLoginURL(data.FormAction)
30
    }
31
    _ = resp.Body.Close()
32
    return data, nil
33
}

1
func ExtractInputValue(html []byte, attrs ...string) string {
2
    htmlStr := string(html)
3

4
    inputPattern := `<input[^>]+`
5
    for _, attr := range attrs {
6
        inputPattern += `[^>]*` + attr + `[^>]*`
7
    }
8
    inputPattern += `[^>]*>`
9

10
    re := regexp.MustCompile(`(?i)` + inputPattern)
11
    match := re.FindString(htmlStr)
12
    if match == "" {
13
        return ""
14
    }
15

16
    valueRe := regexp.MustCompile(`(?i)value\s*=\s*["']([^"']*)["']`)
17
    valueMatch := valueRe.FindStringSubmatch(match)
18
    if len(valueMatch) > 1 {
19
        return valueMatch[1]
20
    }
21
    return ""
22
}
23

24
func ExtractFormAction(html []byte, formID string) string {
25
    htmlStr := string(html)
26
    pattern := `(?is)<form[^>]*\bid\s*=\s*["']` + regexp.QuoteMeta(formID) + `["'][^>]*>`
27
    re := regexp.MustCompile(pattern)
28
    match := re.FindString(htmlStr)
29
    if match == "" {
30
        return ""
31
    }
32

33
    actionRe := regexp.MustCompile(`(?i)\baction\s*=\s*["']([^"']*)["']`)
34
    actionMatch := actionRe.FindStringSubmatch(match)
35
    if len(actionMatch) > 1 {
36
        return actionMatch[1]
37
    }
38
    return ""
39
}
40

41
func ExtractAnyFormAction(html []byte, formIDs ...string) string {
42
    for _, id := range formIDs {
43
        if action := ExtractFormAction(html, id); action != "" {
44
            return action
45
        }
46
    }
47
    return ""
48
}

1
func (r *HttpSpyderCore) CheckNeedCaptcha(username string) (bool, error) {
2
    base := strings.TrimSuffix(r.baseUrl, "/login")
3
    finalURL := fmt.Sprintf("%s/checkNeedCaptcha.htl?username=%s&_=%d",
4
        base, url.QueryEscape(username), time.Now().UnixMilli())
5

6
    req, err := http.NewRequest("GET", finalURL, nil)
7
    if err != nil {
8
        return false, err
9
    }
10
    for key, val := range r.headers {
11
        req.Header.Set(key, val)
12
    }
13
    req.Header.Set("Referer", fmt.Sprintf("%s?service=%s", r.baseUrl, r.targetService))
14

15
    resp, err := r.client.Do(req)
16
    if err != nil {
17
        return false, err
18
    }
19
    defer func() { _ = resp.Body.Close() }()
20
    r.mergeCookiesFromResponse(resp)
21

22
    body, err := io.ReadAll(resp.Body)
23
    if err != nil {
24
        return false, err
25
    }
26

27
    trim := strings.TrimSpace(string(body))
28
    if strings.HasPrefix(trim, "{") {
29
        var data struct { IsNeed bool `json:"isNeed"` }
30
        if err := json.Unmarshal([]byte(trim), &data); err != nil {
31
            return false, err
32
        }
33
        return data.IsNeed, nil
34
    }
35
    switch strings.ToLower(trim) {
36
    case "true":
37
        return true, nil
38
    case "false":
39
        return false, nil
40
    }
41
    return false, fmt.Errorf("unexpected checkNeedCaptcha resp: %q", trim)
42
}

1
func (r *HttpSpyderCore) GetCaptcha() ([]byte, error) {
2
    base := strings.TrimSuffix(r.baseUrl, "/login")
3
    finalURL := fmt.Sprintf("%s/getCaptcha.htl?%d", base, time.Now().UnixMilli())
4

5
    req, err := http.NewRequest("GET", finalURL, nil)
6
    if err != nil {
7
        return nil, err
8
    }
9
    for key, val := range r.headers {
10
        req.Header.Set(key, val)
11
    }
12
    req.Header.Set("Referer", fmt.Sprintf("%s?service=%s", r.baseUrl, r.targetService))
13

14
    resp, err := r.client.Do(req)
15
    if err != nil {
16
        return nil, err
17
    }
18
    defer func() { _ = resp.Body.Close() }()
19
    r.mergeCookiesFromResponse(resp)
20

21
    if resp.StatusCode != http.StatusOK {
22
        return nil, fmt.Errorf("getCaptcha: unexpected status %d", resp.StatusCode)
23
    }
24
    body, err := io.ReadAll(resp.Body)
25
    if err != nil {
26
        return nil, err
27
    }
28
    if len(body) == 0 {
29
        return nil, errors.New("getCaptcha: empty body")
30
    }
31
    return body, nil
32
}

1
func EncryptPasssword(password, salt string) (string, error) {
2
    randomStr, err := randomStringGo(64)
3
    if err != nil {
4
        return "", fmt.Errorf("random error: %w", err)
5
    }
6
    passwordStr := randomStr + password
7

8
    key := []byte(strings.TrimSpace(salt))
9
    if len(key) < 16 {
10
        key = append(key, make([]byte, 16-len(key))...)
11
    } else if len(key) > 16 {
12
        key = key[:16]
13
    }
14

15
    iv, err := randomStringGo(16)
16
    if err != nil {
17
        return "", fmt.Errorf("gen IV fail: %w", err)
18
    }
19

20
    encrypted, err := aesEncryptGo([]byte(passwordStr), key, []byte(iv))
21
    if err != nil {
22
        return "", fmt.Errorf("AES encrypt fail: %w", err)
23
    }
24

25
    encryptedBase64 := base64.StdEncoding.EncodeToString(encrypted)
26
    return url.QueryEscape(encryptedBase64), nil
27
}

1
func (r *HttpSpyderCore) GetLocation(body *strings.Reader) (string, error) {
2
    finalURL := r.loginPostURL()
3

4
    req, err := http.NewRequest("POST", finalURL, body)
5
    if err != nil {
6
        return "", err
7
    }
8
    for key, val := range r.headers {
9
        req.Header.Set(key, val)
10
    }
11
    req.Header.Set("Referer", fmt.Sprintf("%s?service=%s", r.baseUrl, r.targetService))
12
    req.Header.Set("Origin", r.originOf(r.baseUrl))
13

14
    resp, err := r.client.Do(req)
15
    if err != nil {
16
        return "", err
17
    }
18
    r.mergeCookiesFromResponse(resp)
19

20
    if loc := resp.Header.Get("Location"); loc != "" {
21
        _ = resp.Body.Close()
22
        return loc, nil
23
    }
24

25
    if resp.StatusCode == http.StatusOK {
26
        html, err := io.ReadAll(resp.Body)
27
        _ = resp.Body.Close()
28
        if err != nil {
29
            return "", err
30
        }
31
        if strings.Contains(string(html), "\u8e22\u51fa\u4f1a\u8bdd") {
32
            return r.confirmKickoutAndGetLocation(html)
33
        }
34
    }
35
    _ = resp.Body.Close()
36
    return "", nil
37
}

1
func (r *HttpSpyderCore) confirmKickoutAndGetLocation(html []byte) (string, error) {
2
    exec2 := extractor.ExtractInputValue(html, `name="execution"`)
3
    if exec2 == "" {
4
        return "", errors.New("kickout page: execution not found")
5
    }
6

7
    form := fmt.Sprintf("execution=%s&_eventId=continue", url.QueryEscape(exec2))
8
    req, err := http.NewRequest("POST", r.loginPostURL(), strings.NewReader(form))
9
    if err != nil {
10
        return "", err
11
    }
12
    for key, val := range r.headers {
13
        req.Header.Set(key, val)
14
    }
15
    req.Header.Set("Referer", fmt.Sprintf("%s?service=%s", r.baseUrl, r.targetService))
16
    req.Header.Set("Origin", r.originOf(r.baseUrl))
17

18
    resp, err := r.client.Do(req)
19
    if err != nil {
20
        return "", err
21
    }
22
    defer func() { _ = resp.Body.Close() }()
23
    r.mergeCookiesFromResponse(resp)
24

25
    if loc := resp.Header.Get("Location"); loc != "" {
26
        return loc, nil
27
    }
28
    return "", errors.New("kickout confirm: no Location header")
29
}