Merge remote-tracking branch 'upstream/HEAD'

module/register_xeapikey.js

@@ -32,7 +32,7 @@ module.exports = async (query, request) => {
 
   const res = await axios({
     method: 'POST',
-    url: APP_CONF.apiDomain + '/api/gorilla/anti/crawler/security/key/get',
+    url: APP_CONF.apiDomain + '/api/bsr/sk/get',
     headers: {
       'User-Agent':
         'NeteaseMusic/9.5.61.260802021928(9005061);Dalvik/2.1.0 (Linux; U; Android 12; HBN-AL00 Build/cd737a2.0)',

util/crypto.js

@@ -206,9 +206,19 @@ const xeapiMidTransform = (ciphertext) => {
   for (let i = 0; i < ciphertext.length; i++) {
     xored[i] = ciphertext[i] ^ random[i & 0x0f]
   }
-  const b64 = Buffer.from(xored.toString('base64'))
+  const rot = xored.length ? (random[0] & 0x0f) % xored.length : 0
-  const rot = b64.length ? (random[0] & 0x0f) % b64.length : 0
+  return Buffer.concat([random, xored.subarray(rot), xored.subarray(0, rot)])
-  return Buffer.concat([random, b64.subarray(rot), b64.subarray(0, rot)])
+}
+
+const decoder = new TextDecoder('utf-8', { fatal: true })
+
+const isUtf8 = (buf) => {
+  try {
+    decoder.decode(buf)
+    return true
+  } catch {
+    return false
+  }
 }
 
 const xeapiEncryptS = (dynamicKey, publicKeyState, os) => {
@@ -251,8 +261,14 @@ const buildXeapiPlaintext = (uri, data, options = {}) => {
     const bodyData = { ...data }
     delete bodyData.e_r
     const body = Buffer.from(new URLSearchParams(bodyData).toString())
+    if (body.length) {
+      if (mediaType === 'application/x-www-form-urlencoded' && isUtf8(body)) {
+        fields.content = body.toString('utf8')
+      } else {
         fields.body = body.toString('base64')
       }
+    }
+  }
 
   if (fields.queryString) {
     fields.queryString += '&e_r=true'
@@ -274,7 +290,7 @@ const xeapi = (uri, data, options = {}) => {
   const dynamicKey = activeSessionKey || crypto.randomBytes(16)
   const plaintext = Buffer.from(buildXeapiPlaintext(uri, data, options))
 
-  const b = aesEcbEncrypt(
+  const c = aesEcbEncrypt(
     dynamicKey,
     xeapiMidTransform(aesEcbEncrypt(xeapiStaticKey, plaintext)),
   )
@@ -287,7 +303,7 @@ const xeapi = (uri, data, options = {}) => {
   )
 
   return {
-    B: b.toString('base64'),
+    C: c.toString('base64url'),
     S: s.toString('base64'),
     R: r.toString('base64'),
   }