feat!: dropped supporting RSA_PKCS1_PADDING

Author: TheNorthMemory

README.md

@@ -552,15 +552,12 @@ Q: `APIv3`上请求参数敏感信息如何加密？返回参数敏感信息如
 
 > 接口区分国内版还是国际版，国内版的`RSA`填充方案是`RSA_PKCS1_OAEP_PADDING`，方法如下：
 >
-> 请求字段需要密文的，加密方法: `Rsa.encrypt('原始信息', Rsa.from(platformPublicKeyFilePath, Rsa.KEY_TYPE_PUBLIC), Rsa.RSA_PKCS1_OAEP_PADDING)`
+> 加密: `Rsa.encrypt('原始信息', Rsa.from(platformPublicKeyFilePath, Rsa.KEY_TYPE_PUBLIC), Rsa.RSA_PKCS1_OAEP_PADDING)`
 >
-> 返回字段需要明文的，解密方法: `Rsa.decrypt('密文base64', Rsa.from(merchantPrivateKeyFilePath, Rsa.KEY_TYPE_PRIVATE), Rsa.RSA_PKCS1_OAEP_PADDING)`
+> 解密: `Rsa.decrypt('密文base64', Rsa.from(merchantPrivateKeyFilePath, Rsa.KEY_TYPE_PRIVATE), Rsa.RSA_PKCS1_OAEP_PADDING)`
 >
-> 国际版的`RSA`填充方案是`RSA_PKCS1_PADDING`(不是所有node版本都支持)，方法如下：
->
-> 请求字段需要密文的，加密方法: `Rsa.encrypt('原始信息', Rsa.from(platformCertificateFilePath, Rsa.KEY_TYPE_PUBLIC), Rsa.RSA_PKCS1_PADDING)`
->
-> 返回字段需要明文的，解密方法: `Rsa.decrypt('密文base64', Rsa.from(merchantPrivateKeyFilePath, Rsa.KEY_TYPE_PRIVATE), Rsa.RSA_PKCS1_PADDING)`
+> 国际版`RSA`填充方案是`RSA_PKCS1_PADDING`，本类库放弃支持此种`加/解密`填充方案，同时`node18.19.0`也是最后一版默认支持`加密`的版本(延展阅读见[CVE-2023-46809](https://nodejs.org/en/blog/vulnerability/february-2024-security-releases)及[这里](https://github.com/wechatpay-apiv3/wechatpay-php/issues/133))，如需使用，请自行寻替代方案。
+
 
 Q: 如何安全地在应用内使用`APIv2`及`APIv3`对称密钥?
 

index.d.ts

@@ -434,6 +434,7 @@ export namespace WechatpayAxiosPlugin {
         static RSA_PKCS1_OAEP_PADDING: 4;
         /**
          * Alias of the `RSA_PKCS1_PADDING` mode
+         * @deprecated see [CVE-2023-46809](https://nodejs.org/en/blog/vulnerability/february-2024-security-releases)
          */
         static RSA_PKCS1_PADDING: 1;
 
@@ -453,22 +454,20 @@ export namespace WechatpayAxiosPlugin {
 
         /**
          * Encrypts text with sha256WithRSAEncryption/RSA_PKCS1_OAEP_PADDING.
-         * Node Limits >= 12.9.0 (`oaepHash` was added)
          *
          * @param {string} plaintext - Cleartext to encode.
          * @param {KeyLike} publicKey - A public key.
-         * @param {number} [padding] - Supporting `RSA_PKCS1_OAEP_PADDING` or `RSA_PKCS1_PADDING`, default is `RSA_PKCS1_OAEP_PADDING`.
+         * @param {number} [padding] - Supporting `RSA_PKCS1_OAEP_PADDING`, default is `RSA_PKCS1_OAEP_PADDING`.
          *
          * @returns {string} Base64-encoded ciphertext.
          */
         static encrypt(plaintext: string, publicKey: KeyLike, padding?: number): string;
         /**
          * Decrypts base64 encoded string with `privateKey`.
-         * Node Limits >= 12.9.0 (`oaepHash` was added)
          *
          * @param {string} ciphertext - Was previously encrypted string using the corresponding public certificate.
          * @param {KeyLike} privateKey - A public key.
-         * @param {number} [padding] - Supporting `RSA_PKCS1_OAEP_PADDING` or `RSA_PKCS1_PADDING`, default is `RSA_PKCS1_OAEP_PADDING`.
+         * @param {number} [padding] - Supporting `RSA_PKCS1_OAEP_PADDING`, default is `RSA_PKCS1_OAEP_PADDING`.
          *
          * @returns {string} Utf-8 plaintext.
          */

lib/rsa.js

@@ -30,13 +30,13 @@ const RULES = {
 };
 
 /**
- * @param {number} code - Supporting `RSA_PKCS1_OAEP_PADDING` or `RSA_PKCS1_PADDING`, default is `RSA_PKCS1_OAEP_PADDING`.
- * @throws {RangeError} - While the padding isn't `RSA_PKCS1_OAEP_PADDING` nor `RSA_PKCS1_PADDING`.
+ * @param {number} code - Supporting `RSA_PKCS1_OAEP_PADDING, default is `RSA_PKCS1_OAEP_PADDING`.
+ * @throws {RangeError} - While the padding isn't `RSA_PKCS1_OAEP_PADDING`.
  * @returns {void}
  */
 function paddingModeLimitedCheck(code) {
-  if (!(code === RSA_PKCS1_PADDING || code === RSA_PKCS1_OAEP_PADDING)) {
-    throw new RangeError(`Doesn't supported the padding mode(${code}), here's only support RSA_PKCS1_OAEP_PADDING or RSA_PKCS1_PADDING.`);
+  if (code !== RSA_PKCS1_OAEP_PADDING) {
+    throw new RangeError(`Doesn't supported the padding mode(${code}), here's only support RSA_PKCS1_OAEP_PADDING.`);
   }
 }
 
@@ -46,6 +46,9 @@ function paddingModeLimitedCheck(code) {
 class Rsa {
   static RSA_PKCS1_OAEP_PADDING = RSA_PKCS1_OAEP_PADDING
 
+  /**
+   * @deprecated see [CVE-2023-46809](https://nodejs.org/en/blog/vulnerability/february-2024-security-releases)
+   */
   static RSA_PKCS1_PADDING = RSA_PKCS1_PADDING
 
   /** Type string of the asymmetric key */
@@ -124,10 +127,10 @@ class Rsa {
    *
    * @param {string} plaintext - Cleartext to encode.
    * @param {KeyLike} publicKey - The `RsaPublicKey`.
-   * @param {number} [padding = RSA_PKCS1_OAEP_PADDING] - Value of the `RSA_PKCS1_OAEP_PADDING` or `RSA_PKCS1_PADDING`, default is `RSA_PKCS1_OAEP_PADDING`.
+   * @param {number} [padding = RSA_PKCS1_OAEP_PADDING] - Value of the `RSA_PKCS1_OAEP_PADDING, default is `RSA_PKCS1_OAEP_PADDING`.
    *
    * @returns {string} Base64-encoded ciphertext.
-   * @throws {RangeError} - While the padding isn't `RSA_PKCS1_OAEP_PADDING` nor `RSA_PKCS1_PADDING`.
+   * @throws {RangeError} - While the padding isn't `RSA_PKCS1_OAEP_PADDING`.
    */
   static encrypt(plaintext, publicKey, padding = RSA_PKCS1_OAEP_PADDING) {
     paddingModeLimitedCheck(padding);
@@ -143,10 +146,10 @@ class Rsa {
    *
    * @param {string} ciphertext - Was previously encrypted string using the corresponding public certificate.
    * @param {KeyLike} privateKey - The `RsaPrivateKey`.
-   * @param {number} [padding = RSA_PKCS1_OAEP_PADDING] - Value of the `RSA_PKCS1_OAEP_PADDING` or `RSA_PKCS1_PADDING`, default is `RSA_PKCS1_OAEP_PADDING`.
+   * @param {number} [padding = RSA_PKCS1_OAEP_PADDING] - Value of the `RSA_PKCS1_OAEP_PADDING, default is `RSA_PKCS1_OAEP_PADDING`.
    *
    * @returns {string} Utf-8 plaintext.
-   * @throws {RangeError} - While the padding isn't `RSA_PKCS1_OAEP_PADDING` nor `RSA_PKCS1_PADDING`.
+   * @throws {RangeError} - While the padding isn't `RSA_PKCS1_OAEP_PADDING`.
    */
   static decrypt(ciphertext, privateKey, padding = RSA_PKCS1_OAEP_PADDING) {
     paddingModeLimitedCheck(padding);