T09 · Insecure Skill Coding Practices
Warning
- Location
references/apidocs/alipay.open.sp.inteop.sync.notify.md:7- Finding
Webhook Processing Guidance Omits Mandatory Signature and Replay Verification
- Content
View full analysis
Vulnerability Details
File Location:
references/apidocs/alipay.open.sp.inteop.sync.notify.md, lines 7–20 and 60–99
Vulnerability Type: Missing webhook authentication and replay protection guidance
Risk Level: MediumVulnerable Documentation Snippet
markdown **说明**：本接口为支付宝消息推送接口，不是主动调用接口。开发者需要在开放平台控制台配置应用网关（NOTIFY_URL），支付宝会将通知 POST 到该地址。 --- ### 通知公共参数 | 参数 | 类型 | 必填 | 说明 | |-----------------|--------|----|-----------------------| | `notify_id` | string | 是 | 通知ID | | `utc_timestamp` | string | 是 | 消息发送时的服务端时间（毫秒时间戳） | | `msg_method` | string | 是 | 消息接口名称 | | `app_id` | string | 是 | 消息接受方的应用id | | `version` | string | 是 | 版本号，1.0或1.1（1.1为标准消息） | | `biz_content` | string | 是 | 消息报文，见消息属性 | | `sign` | string | 是 | 签名 | | `sign_type` | string | 是 | 签名类型：RSA2 | | `charset` | string | 是 | 编码集，如UTF-8 | --- ### 通知应答 服务商接收到通知后，需要返回应答报文告知支付宝是否处理成功： | 应答报文 | 是否重试 | 说明 | |-----------|------|------------------------| | `success` | 否 | 消息处理成功，支付宝停止投递 | | `fail` | 是 | 消息处理失败，支付宝根据投递重试策略重新发送 | **投递重试策略**：一般情况下，25小时内完成8次通知，除了第一次是实时投递外，后续重试间隔为：2m、10m、10m、1h、2h、6h、15h。 --- ### 消息示例 ```bash curl -X POST 'NOTIFY_URL' \ --header 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \ --data-urlencode 'charset=UTF-8' \ --data-urlencode 'biz_content={ "inteop_order_no":"2025082154665410", "status":"APPLY_SUCCESS", "sub_order_infos":[ { "reason":"营业执照不符合规范", "sub_order_status":"AUDITING", "sub_order_no":"2025082154665410", "type":"AUTH" } ] }' \ --data-urlencode 'utc_timestamp=${now}' \ --data-urlencode 'sign=${sign}' \ --data-urlencode 'app_id=${appid} ...[truncated 3376 chars]- Remediation
View remediation
Remediation Suggestions
- Add an explicit mandatory verification section before the response-handling instructions.
- Require RSA2 signature verification using the trusted Alipay public key and the official canonical parameter construction rules. Verification must occur before parsing or acting on
biz_content. - Reject requests with missing or invalid signatures and never return
successfor an unverified message. - Validate that
app_idequals the receiver's configured application ID. - Require the exact expected
msg_method, supportedversion, andsign_type=RSA2. - Parse
utc_timestampstrictly, enforce a narrow acceptable time window, and reject stale or future-dated messages. - Persist
notify_idunder a uniqueness constraint and process each notification idempotently. Record the notification identifier and processing result atomically with the business-state update. - Confirm sensitive terminal transitions through an authenticated Alipay order-query API before granting services or performing irreversible actions.
- Return
successonly after successful authentication and atomic processing. Returnfailfor transient internal failures, while permanently rejecting unauthenticated requests without performing business actions. - Add secure receiver pseudocode that demonstrates signature verification, context validation, replay checks, strict payload validation, and idempotent state transitions.
- Avoid logging raw signatures, authorization tokens, credentials, or unnecessary merchant information during verification failures.