From 808ff75d6725f3e173420374c695cb39cdc2824c Mon Sep 17 00:00:00 2001 From: unknown Date: Tue, 21 Apr 2026 11:57:53 +0300 Subject: [PATCH] 231 append pseudorandom --- v1/Application.cfc | 2 +- v1/lib/TokenGenerator.cfc | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/v1/Application.cfc b/v1/Application.cfc index cebc447..d3a7f08 100644 --- a/v1/Application.cfc +++ b/v1/Application.cfc @@ -57,7 +57,7 @@ //variables.framework.docs={}; variables.framework.docs.APIName="svc-api"; - variables.framework.docs.APIVersion="0.230"; /*$ git config --global --unset user.password*/ + variables.framework.docs.APIVersion="0.231"; /*$ git config --global --unset user.password*/ variables.framework.globalHeaders = structNew(); variables.framework.globalHeaders["Access-Control-Expose-Headers"] = "Location"; diff --git a/v1/lib/TokenGenerator.cfc b/v1/lib/TokenGenerator.cfc index d67bfb9..7f9e74a 100644 --- a/v1/lib/TokenGenerator.cfc +++ b/v1/lib/TokenGenerator.cfc @@ -122,14 +122,19 @@ component /*https://www.bennadel.com/blog/2976-trying-to-generate-cryptographica */ private string function encodeBytes( required binary bytes ) { - var token = binaryEncode( bytes, "base64" ); + var token = binaryEncode( bytes, "base64" ); // *** вот поэтому длина отличается от заявленной // Replace the characters that are not allowed in the base64url format. The // characters [+, /, =] are removed for URL-based base64 values because they // have significant meaning in the context of URL paths and query-strings. - token = replace( token, "+", "-", "all" ); + /*token = replace( token, "+", "-", "all" ); token = replace( token, "/", "_", "all" ); - token = replace( token, "=", "", "all" ); + token = replace( token, "=", "", "all" ); */ + + // мы хотим убрать все спецсимволы, потому что мы используем токен в качестве псевдослучайного суффикса + token = replace( token, "+", "a", "all" ); + token = replace( token, "/", "b", "all" ); + token = replace( token, "=", "c", "all" ); return( token );