Skip to content

Fix WeChat Pay profit-sharing callback signature verification line separator inconsistency #3649

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 3 commits into
base: develop
Choose a base branch
from

Conversation

Copilot
Copy link
Contributor

@Copilot Copilot AI commented Jul 24, 2025

Problem

The ProfitSharingServiceImpl.verifyNotifySign() method was using platform-specific line separators (%n) while the base implementation uses LF (\n), causing signature verification failures in WeChat Pay Service Provider Mode profit-sharing callbacks.

Root Cause

WeChat Pay signature verification requires consistent use of LF (\n) as line separator. The profit-sharing service was using:

String beforeSign = String.format("%s%n%s%n%s%n", header.getTimeStamp(), header.getNonce(), data);

While the base implementation correctly uses:

String beforeSign = String.format("%s\n%s\n%s\n", header.getTimeStamp(), header.getNonce(), data);

The %n format specifier produces platform-specific line separators (LF on Unix/Linux, CRLF on Windows), causing signature verification to fail with "非法请求,头部信息验证失败" (Illegal request, header verification failed) errors.

Solution

  1. Fixed line separator format: Changed from %n to \n to ensure consistent LF line separators across all platforms
  2. Added signature test traffic detection: Added check for WECHATPAY/SIGNTEST/ prefix to properly handle WeChat Pay signature test traffic
  3. Added proper exception handling: Imported and used WxSignTestException for signature test scenarios

Changes Made

  • Updated ProfitSharingServiceImpl.verifyNotifySign() to use \n instead of %n
  • Added signature test traffic detection with proper exception handling
  • Added missing import for WxSignTestException

This ensures consistency with other service implementations and resolves signature verification failures in profit-sharing callbacks.

Fixes #3634.


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

@Copilot Copilot AI changed the title [WIP] 微信支付服务商模式 分账回调时bug Fix WeChat Pay profit-sharing callback signature verification line separator inconsistency Jul 24, 2025
@Copilot Copilot AI requested a review from binarywang July 24, 2025 07:58
Copilot finished work on behalf of binarywang July 24, 2025 07:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

微信支付服务商模式 分账回调时bug
2 participants