加固后怎样验证 Play Integrity 请求绑定

#!/usr/bin/env python3
import sys
import json
import hashlib
from pathlib import Path

def canonical_json(obj):
    """Generate RFC 8785 JCS canonical JSON string."""
    return json.dumps(obj, sort_keys=True, separators=(',', ':'), ensure_ascii=False)

def compute_sha256_hex(data_str):
    """Compute SHA-256 hex digest of a UTF-8 encoded string."""
    return hashlib.sha256(data_str.encode('utf-8')).hexdigest()

def main():
    if len(sys.argv) != 2:
        print("Usage: verify_binding.py <integrity_check_result.json>", file=sys.stderr)
        raise SystemExit(2)

    input_path = Path(sys.argv[1])
    if not input_path.is_file():
        print(f"Error: File '{input_path}' not found.", file=sys.stderr)
        raise SystemExit(2)

    try:
        content = input_path.read_text(encoding='utf-8')
        data = json.loads(content)
    except (json.JSONDecodeError, OSError) as e:
        print(f"Failed to parse input file: {e}", file=sys.stderr)
        raise SystemExit(2)

    client_request_hash = data.get("requestHash")
    business_request_payload = data.get("businessRequest")
    expected_nonce = data.get("nonceBound")
    actual_nonce = data.get("nonce")

    if not isinstance(client_request_hash, str) or not client_request_hash:
        print("Validation failed: Missing or invalid 'requestHash' in input.", file=sys.stderr)
        raise SystemExit(2)

    if not isinstance(business_request_payload, dict) or not business_request_payload:
        print("Validation failed: Missing or invalid 'businessRequest' object in input.", file=sys.stderr)
        raise SystemExit(2)

    canonical_body = canonical_json(business_request_payload)
    computed_hash = compute_sha256_hex(canonical_body)

    if client_request_hash != computed_hash:
        print("Validation failed: requestHash mismatch indicates binding breakage.", file=sys.stderr)
        raise SystemExit(2)

    if expected_nonce is not None and actual_nonce != expected_nonce:
        print("Validation failed: Nonce mismatch detected, possible replay attack.", file=sys.stderr)
        raise SystemExit(2)

    print("Request binding verification successful: hash and nonce match.")

if __name__ == "__main__":
    main()

import java.nio.file.Files
import java.nio.file.Path
import java.security.MessageDigest
import kotlin.system.exitProcess

private fun hex(bytes: ByteArray): String =
    bytes.joinToString("") { byte -> "%02x".format(byte) }

fun main(args: Array<String>) {
    if (args.size != 2) {
        System.err.println("usage: verify-request-hash <canonical-request-file> <expected-sha256>")
        exitProcess(2)
    }

    val requestPath = Path.of(args[0])
    if (!Files.isRegularFile(requestPath)) {
        System.err.println("request body file is missing")
        exitProcess(2)
    }

    val expected = args[1].lowercase()
    if (!Regex("[0-9a-f]{64}").matches(expected)) {
        System.err.println("expected requestHash must be 64 hexadecimal characters")
        exitProcess(2)
    }

    val requestBytes = Files.readAllBytes(requestPath)
    val actual = hex(MessageDigest.getInstance("SHA-256").digest(requestBytes))
    if (!MessageDigest.isEqual(actual.toByteArray(), expected.toByteArray())) {
        System.err.println("requestHash does not match the canonical request body")
        exitProcess(1)
    }

    println("requestHash matches the canonical request body")
}