From fd54ac989830e5fab42c1fa7ed0f227011758f80 Mon Sep 17 00:00:00 2001 From: smail Date: Tue, 22 Sep 2026 04:39:55 +0800 Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85=E9=98=BF=E9=87=8C=E4=BA=91DN?= =?UTF-8?q?S=E7=AD=BE=E5=90=8D=E5=85=BC=E5=AE=B9=E8=AF=B4=E6=98=8E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/services/setup/ssl/dns_automatic.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/services/setup/ssl/dns_automatic.go b/backend/services/setup/ssl/dns_automatic.go index afb232d..35c985d 100644 --- a/backend/services/setup/ssl/dns_automatic.go +++ b/backend/services/setup/ssl/dns_automatic.go @@ -197,7 +197,9 @@ func (provider *aliDNSChallenge) call(action string, values url.Values, target a values.Set("SignatureNonce", hex.EncodeToString(nonce)) values.Set("Timestamp", time.Now().UTC().Format("2006-01-02T15:04:05Z")) canonical := strings.ReplaceAll(values.Encode(), "+", "%20") - mac := hmac.New(sha1.New, []byte(provider.secretKey+"&")) + // 阿里云 DNS RPC API 的当前签名协议固定使用 HMAC-SHA1；此处不能自行替换为 SHA-256， + // 否则服务商会拒绝请求。请求通过 HTTPS 发送，密钥只用于内存中的签名计算。 + mac := hmac.New(sha1.New, []byte(provider.secretKey+"&")) // #nosec G505 -- 阿里云 DNS RPC API 要求 HMAC-SHA1 _, _ = mac.Write([]byte("POST&%2F&" + aliDNSPercentEncode(canonical))) values.Set("Signature", base64.StdEncoding.EncodeToString(mac.Sum(nil))) request, err := http.NewRequest(http.MethodPost, provider.endpoint, strings.NewReader(values.Encode()))