line-bot-api 2.2.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 44ce823e0e9998cc204a39d55321ec85e6b7903adcf7ed1630b222c69116566a
-  data.tar.gz: 9a8119c82379fe431bc8ccaa4526e4647256f41179d3edd4022643712911ddc8
+  metadata.gz: 32bc05debf174d2fd40d7fe9b39eca826829773b732cd622b75025c8119806ef
+  data.tar.gz: 2755c22b1b43d31e3747f0523996b6ce2591e731b0b87e2b0a493c5697eec8a4
 SHA512:
-  metadata.gz: 6999af99e5f87523518756b29690f4036762924037cf38cc1c11c614c8d2721a125b8c4b8046c9095f2efd38db5d6ceb2430f6e91de775f3e9f7d66c5a2a33c7
-  data.tar.gz: a3dd071068394ed5dfd5f565f8dd1bdf1a306b8be83c99d10c503d704b9839b3df168b77a2ef0b5bb9fa14b1cdc5c6dfd92833663dbc6e227e4e0e91a5d94f27
+  metadata.gz: '06943b31d09d0a9833316c30b35711a66be1446c529a254b2a230ca05758b2e1402fd79986a6c1d3226adb9f58d6ebccb6c68953ff41f765529edfcd2c0e871d'
+  data.tar.gz: 50faa1171d680adabd94ffa8d610d05105082ee8d866fe63da04ecd1100131b3d0d95d6a2b603d505ba69eeefa0994d4c39fbbbe9d460520851aaa9f09113239

data/lib/line/bot/v2/webhook_parser.rb

@@ -11,8 +11,20 @@ module Line
       class WebhookParser
         class InvalidSignatureError < StandardError; end
 
-        def initialize(channel_secret:)
+        # Initialize webhook parser
+        #
+        # @param channel_secret [String]
+        #   The channel secret used for signature verification.
+        # @param skip_signature_verification [() -> bool, nil]
+        #   A callable object with type `() -> bool` that determines whether to skip
+        #   webhook signature verification. Signature verification is skipped if and
+        #   only if this callable is provided and returns `true`.
+        #   This can be useful in scenarios such as when you're in the process of
+        #   updating the channel secret and need to temporarily bypass verification
+        #   to avoid disruptions.
+        def initialize(channel_secret:, skip_signature_verification: nil)
           @channel_secret = channel_secret
+          @skip_signature_verification = skip_signature_verification
         end
 
         # Parse events from the raw request body and validate the signature.
@@ -31,7 +43,10 @@ module Line
         #
         # @example Sinatra usage
         #   def parser
-        #     @parser ||= Line::Bot::V2::WebhookParser.new(channel_secret: ENV.fetch("LINE_CHANNEL_SECRET"))
+        #     @parser ||= Line::Bot::V2::WebhookParser.new(
+        #       channel_secret: ENV.fetch("LINE_CHANNEL_SECRET"),
+        #       skip_signature_verification: -> { ENV['SKIP_SIGNATURE_VERIFICATION'] == 'true' }
+        #     )
         #   end
         #
         #   post '/callback' do
@@ -54,7 +69,11 @@ module Line
         #     "OK"
         #   end
         def parse(body:, signature:)
-          raise InvalidSignatureError.new("Invalid signature: #{signature}") unless verify_signature(body: body, signature: signature)
+          should_skip = @skip_signature_verification&.call || false
+
+          unless should_skip == true || verify_signature(body: body, signature: signature)
+            raise InvalidSignatureError.new("Invalid signature: #{signature}")
+          end
 
           data = JSON.parse(body.chomp, symbolize_names: true)
           data = Line::Bot::V2::Utils.deep_underscore(data)
@@ -66,14 +85,14 @@ module Line
           end
         end
 
-        private
-
         def verify_signature(body:, signature:)
           hash = OpenSSL::HMAC.digest(OpenSSL::Digest.new('SHA256'), @channel_secret, body)
           expected = Base64.strict_encode64(hash)
           variable_secure_compare(signature, expected)
         end
 
+        private
+
         # To avoid timing attacks
         def variable_secure_compare(a, b)
           secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))

data/lib/line/bot/version.rb

@@ -2,6 +2,6 @@ module Line
   module Bot
     # This version is updated before releasing a new version in the release process.
     # You don't have to update this version manually.
-    VERSION = "2.2.0"
+    VERSION = "2.3.0"
   end
 end

data/sig/line/bot/v2/webhook_parser.rbs

@@ -5,18 +5,19 @@ module Line
         class InvalidSignatureError < ::StandardError
         end
         @channel_secret: String
+        @skip_signature_verification: (^() -> bool) | nil
 
-        def initialize: (channel_secret: String) -> void
+        def initialize: (channel_secret: String, ?skip_signature_verification: (^() -> bool) | nil) -> void
 
         def parse: (
             body: String,
             signature: String
           ) -> Array[Webhook::Event]
+          
+        def verify_signature: (body: String, signature: String) -> bool
 
         private
 
-        def verify_signature: (body: String, signature: String) -> bool
-
         def variable_secure_compare: (String, String) -> bool
 
         def secure_compare: (String, String) -> bool

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: line-bot-api
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - LINE Corporation
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-26 00:00:00.000000000 Z
+date: 2025-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multipart-post