手机文件安全信息云查服务

#!/usr/bin/env bash
set -euo pipefail

APPID=""  # apikey
SECRET=""  # salt
URL="https://api.f.360.cn/files/apk/v1/cloud_safe_info"
BODY='{"data":[{"sha1":"37f3ee59b50e28e6e3bd4bc058c363ac9c047317"},{"sha1":"c44f8bacb905cf3deec0104ed8beef1a9298346b"}]}'

NONCE=$(printf '%08d' $((RANDOM % 100000000)))
TIMESTAMP=$(date +%s)
BODY_MD5=$(printf '%s' "$BODY" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=$(printf '%s' "${BODY_MD5}${APPID}${NONCE}${TIMESTAMP}${SECRET}" | openssl dgst -md5 -hex | awk '{print $NF}')
SIGNATURE=${SIGNATURE:16}

curl --location --request POST "$URL" \
  --header "Content-Type: application/json" \
  --header "X-360-Key: ${APPID}" \
  --header "X-360-Nonce: ${NONCE}" \
  --header "X-360-Timestamp: ${TIMESTAMP}" \
  --header "X-360-Signature: ${SIGNATURE}" \
  --data "${BODY}"

import getopt
import hashlib
import json
import random
import sys
import time

import requests


def http_post(host, path, headers, body):
    url = host + path
    response = requests.post(url=url, data=body, headers=headers)
    print(response.status_code)
    print(response.text)


def make_headers(appid, secret, body):
    headers = {}
    headers["X-360-Key"] = appid
    headers["X-360-Nonce"] = str(random.randint(0, 99999999)).zfill(8)
    headers["X-360-Timestamp"] = str(int(time.time()))

    s = (
        hashlib.md5(body.encode("utf8")).hexdigest()
        + headers["X-360-Key"]
        + headers["X-360-Nonce"]
        + headers["X-360-Timestamp"]
        + secret
    )
    md5 = hashlib.md5(s.encode("utf8")).hexdigest()
    headers["X-360-Signature"] = md5[16:]
    headers["Content-Type"] = "application/json"
    return headers


def make_body(sha1s_str):
    samples = []
    sha1s = sha1s_str.split(",")
    for sha1 in sha1s:
        samples.append({"sha1": sha1})

    body = {"data": samples}
    return json.dumps(body)


if __name__ == "__main__":
    usage = """
    api_tool.py -a appid -s secret -h host -p path -m sha1,sha1...
    """

    appid = ".."  # apikey
    secret = ".."  # salt
    host = "https://api.f.360.cn"
    path = "/files/apk/v1/cloud_safe_info"
    sha1s = "37f3ee59b50e28e6e3bd4bc058c363ac9c047317,c44f8bacb905cf3deec0104ed8beef1a9298346b"

    try:
        opts, args = getopt.getopt(
            sys.argv[1:],
            "a:s:h:p:m:",
            ["appid=", "secret=", "host=", "path=", "sha1s="],
        )
    except getopt.GetoptError:
        print(usage)
        sys.exit(1)

    for opt, arg in opts:
        if opt == "-a":
            appid = arg
        elif opt == "-s":
            secret = arg
        elif opt == "-h":
            host = arg
        elif opt == "-p":
            path = arg
        elif opt == "-m":
            sha1s = arg

    if host == "":
        print("host error")

    body = make_body(sha1s)
    headers = make_headers(appid, secret, body)
    http_post(host, path, headers, body)

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.concurrent.ThreadLocalRandom;

public class Demo {
    static String md5(String input) throws Exception {
        byte[] digest = MessageDigest.getInstance("MD5")
                .digest(input.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : digest) {
            sb.append(String.format("%02x", b & 0xff));
        }
        return sb.toString();
    }

    public static void main(String[] args) throws Exception {
        String appid = ""; // apikey
        String secret = ""; // salt
        String url = "https://api.f.360.cn/files/apk/v1/cloud_safe_info";
        String body = "{\"data\":[{\"sha1\":\"37f3ee59b50e28e6e3bd4bc058c363ac9c047317\"},{\"sha1\":\"c44f8bacb905cf3deec0104ed8beef1a9298346b\"}]}";

        String nonce = String.format("%08d", ThreadLocalRandom.current().nextInt(100000000));
        String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
        String signature = md5(md5(body) + appid + nonce + timestamp + secret).substring(16);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(url))
                .header("Content-Type", "application/json")
                .header("X-360-Key", appid)
                .header("X-360-Nonce", nonce)
                .header("X-360-Timestamp", timestamp)
                .header("X-360-Signature", signature)
                .POST(HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8))
                .build();

        HttpClient client = HttpClient.newHttpClient();
        HttpResponse<String> response = client.send(
                request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
        System.out.println(response.body());
    }
}

<?php

// apikey
$appid = "";
// salt
$secret = "";
$url = 'https://api.f.360.cn/files/apk/v1/cloud_safe_info';
$body = json_encode([
    'data' => [
        ['sha1' => '37f3ee59b50e28e6e3bd4bc058c363ac9c047317'],
        ['sha1' => 'c44f8bacb905cf3deec0104ed8beef1a9298346b'],
    ],
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);

$nonce = str_pad((string) random_int(0, 99999999), 8, "0", STR_PAD_LEFT);
$timestamp = (string) time();
$signature = substr(md5(md5($body) . $appid . $nonce . $timestamp . $secret), 16);

$ch = curl_init($url);
$options = [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "X-360-Key: {$appid}",
        "X-360-Nonce: {$nonce}",
        "X-360-Timestamp: {$timestamp}",
        "X-360-Signature: {$signature}",
    ],
];
$options[CURLOPT_POST] = true;
$options[CURLOPT_POSTFIELDS] = $body;
curl_setopt_array($ch, $options);

$response = curl_exec($ch);
if ($response === false) {
    echo curl_error($ch), PHP_EOL;
} else {
    echo $response, PHP_EOL;
}
curl_close($ch);

package main

import (
	"bytes"
	"crypto/md5"
	"encoding/hex"
	"fmt"
	"io"
	"math/rand"
	"net/http"
	"time"
)

func md5Hex(s string) string {
	sum := md5.Sum([]byte(s))
	return hex.EncodeToString(sum[:])
}

func main() {
	appid := ""  // apikey
	secret := "" // salt
	url := "https://api.f.360.cn/files/apk/v1/cloud_safe_info"
	body := []byte(`{"data":[{"sha1":"37f3ee59b50e28e6e3bd4bc058c363ac9c047317"},{"sha1":"c44f8bacb905cf3deec0104ed8beef1a9298346b"}]}`)

	nonce := fmt.Sprintf("%08d", rand.Intn(100000000))
	timestamp := fmt.Sprintf("%d", time.Now().Unix())
	signature := md5Hex(md5Hex(string(body)) + appid + nonce + timestamp + secret)[16:]

	req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
	if err != nil {
		panic(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-360-Key", appid)
	req.Header.Set("X-360-Nonce", nonce)
	req.Header.Set("X-360-Timestamp", timestamp)
	req.Header.Set("X-360-Signature", signature)

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	respBody, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(string(respBody))
}