Skip to content

初步接入米家小爱音箱 #250

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

初步接入米家小爱音箱 #250

wants to merge 1 commit into from

Conversation

Soulter
Copy link
Member

@Soulter Soulter commented Jan 24, 2025

No description provided.

github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 24, 2025
View reviewed changes
astrbot/core/platform/sources/mispeaker/miservice/miaccount.py
'_sign': resp['_sign'],
'callback': resp['callback'],
'user': self.username,
'hash': hashlib.md5(self.password.encode()).hexdigest().upper()

Check failure

Code scanning / CodeQL

Use of a broken or weak cryptographic hashing algorithm on sensitive data

[Sensitive data (password)](1) is used in a hashing algorithm (MD5) that is insecure for password hashing, since it is not a computationally expensive hash function.

Copilot Autofix

AI 3 months ago

To fix the problem, we need to replace the use of the MD5 hashing algorithm with a more secure and computationally expensive hashing algorithm suitable for passwords. One of the best options is to use the argon2 algorithm, which is designed for secure password hashing. This will involve importing the argon2 library and updating the code to use argon2 for hashing the password.

  1. Install the argon2-cffi package if it is not already installed.
  2. Import the PasswordHasher class from the argon2 library.
  3. Replace the MD5 hashing code with argon2 hashing.
Suggested changeset 2
astrbot/core/platform/sources/mispeaker/miservice/miaccount.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/astrbot/core/platform/sources/mispeaker/miservice/miaccount.py b/astrbot/core/platform/sources/mispeaker/miservice/miaccount.py
--- a/astrbot/core/platform/sources/mispeaker/miservice/miaccount.py
+++ b/astrbot/core/platform/sources/mispeaker/miservice/miaccount.py
@@ -1,3 +1,2 @@
 import base64
-import hashlib
 import json
@@ -10,2 +9,3 @@
 from aiofiles import open as async_open
+from argon2 import PasswordHasher
 
@@ -51,2 +51,3 @@
         self.token = None
+        self.ph = PasswordHasher()
 
@@ -65,3 +66,3 @@
                     'user': self.username,
-                    'hash': hashlib.md5(self.password.encode()).hexdigest().upper()
+                    'hash': self.ph.hash(self.password)
                 }
EOF
@@ -1,3 +1,2 @@
import base64
import hashlib
import json
@@ -10,2 +9,3 @@
from aiofiles import open as async_open
from argon2 import PasswordHasher

@@ -51,2 +51,3 @@
self.token = None
self.ph = PasswordHasher()

@@ -65,3 +66,3 @@
'user': self.username,
'hash': hashlib.md5(self.password.encode()).hexdigest().upper()
'hash': self.ph.hash(self.password)
}
requirements.txt
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/requirements.txt b/requirements.txt
--- a/requirements.txt
+++ b/requirements.txt
@@ -19,2 +19,3 @@
 aiodocker
-silk-python
\ No newline at end of file
+silk-python
+argon2-cffi==23.1.0
\ No newline at end of file
EOF
@@ -19,2 +19,3 @@
aiodocker
silk-python
silk-python
argon2-cffi==23.1.0
This fix introduces these dependencies
Package Version Security advisories
argon2-cffi (pypi) 23.1.0 None
Copilot is powered by AI and may make mistakes. Always verify output.
astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
def miot_decode(ssecurity, nonce, data, gzip=False):
from Crypto.Cipher import ARC4
r = ARC4.new(base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce)))
r.encrypt(bytes(1024))

Check failure

Code scanning / CodeQL

Use of a broken or weak cryptographic algorithm

[The cryptographic algorithm ARC4](1) is broken or weak, and should not be used.

Copilot Autofix

AI 3 months ago

To fix the problem, we need to replace the use of the ARC4 algorithm with a more secure algorithm, such as AES. This involves:

  • Importing the AES module from Crypto.Cipher.
  • Modifying the miot_decode method to use AES for decryption.
  • Ensuring that the key and data are appropriately handled for AES encryption/decryption.
Suggested changeset 1
astrbot/core/platform/sources/mispeaker/miservice/miioservice.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py b/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
--- a/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
+++ b/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
@@ -165,6 +165,6 @@
     def miot_decode(ssecurity, nonce, data, gzip=False):
-        from Crypto.Cipher import ARC4
-        r = ARC4.new(base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce)))
-        r.encrypt(bytes(1024))
-        decrypted = r.encrypt(base64.b64decode(data))
+        from Crypto.Cipher import AES
+        key = base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce))
+        cipher = AES.new(key, AES.MODE_EAX, nonce=base64.b64decode(nonce))
+        decrypted = cipher.decrypt(base64.b64decode(data))
         if gzip:
EOF
@@ -165,6 +165,6 @@
def miot_decode(ssecurity, nonce, data, gzip=False):
from Crypto.Cipher import ARC4
r = ARC4.new(base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce)))
r.encrypt(bytes(1024))
decrypted = r.encrypt(base64.b64decode(data))
from Crypto.Cipher import AES
key = base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce))
cipher = AES.new(key, AES.MODE_EAX, nonce=base64.b64decode(nonce))
decrypted = cipher.decrypt(base64.b64decode(data))
if gzip:
Copilot is powered by AI and may make mistakes. Always verify output.
astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
from Crypto.Cipher import ARC4
r = ARC4.new(base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce)))
r.encrypt(bytes(1024))
decrypted = r.encrypt(base64.b64decode(data))

Check failure

Code scanning / CodeQL

Use of a broken or weak cryptographic algorithm

[The cryptographic algorithm ARC4](1) is broken or weak, and should not be used.

Copilot Autofix

AI 3 months ago

To fix the problem, we should replace the use of the ARC4 algorithm with a stronger, modern cryptographic algorithm such as AES. The pycryptodome library provides an implementation of AES that we can use. Specifically, we will use AES in CTR (Counter) mode, which is suitable for stream encryption and is a direct replacement for ARC4 in this context.

We need to:

  1. Import the AES module from Crypto.Cipher.
  2. Replace the ARC4 cipher initialization with AES.
  3. Adjust the encryption process to use AES.
Suggested changeset 1
astrbot/core/platform/sources/mispeaker/miservice/miioservice.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py b/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
--- a/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
+++ b/astrbot/core/platform/sources/mispeaker/miservice/miioservice.py
@@ -165,6 +165,8 @@
     def miot_decode(ssecurity, nonce, data, gzip=False):
-        from Crypto.Cipher import ARC4
-        r = ARC4.new(base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce)))
-        r.encrypt(bytes(1024))
-        decrypted = r.encrypt(base64.b64decode(data))
+        from Crypto.Cipher import AES
+        from Crypto.Util import Counter
+        key = base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce))
+        ctr = Counter.new(128, initial_value=int.from_bytes(base64.b64decode(nonce), byteorder='big'))
+        cipher = AES.new(key, AES.MODE_CTR, counter=ctr)
+        decrypted = cipher.decrypt(base64.b64decode(data))
         if gzip:
EOF
@@ -165,6 +165,8 @@
def miot_decode(ssecurity, nonce, data, gzip=False):
from Crypto.Cipher import ARC4
r = ARC4.new(base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce)))
r.encrypt(bytes(1024))
decrypted = r.encrypt(base64.b64decode(data))
from Crypto.Cipher import AES
from Crypto.Util import Counter
key = base64.b64decode(MiIOService.sign_nonce(ssecurity, nonce))
ctr = Counter.new(128, initial_value=int.from_bytes(base64.b64decode(nonce), byteorder='big'))
cipher = AES.new(key, AES.MODE_CTR, counter=ctr)
decrypted = cipher.decrypt(base64.b64decode(data))
if gzip:
Copilot is powered by AI and may make mistakes. Always verify output.
@Soulter Soulter force-pushed the feat-platform-mispeaker branch from 99edcc5 to 6c18971 Compare March 7, 2025 02:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@Soulter