twilio-ruby-authenticate-webhooks 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc8744d924736377123f5b2b66e9366b5711721cd57a272128864e068e3df20f
-  data.tar.gz: 62c63f5230c6de87cf41c535fd8dfa6f208ce03ad6e68fc8e011b5966f175d65
+  metadata.gz: 57bc2fbef36adaa28582225cd18839f1ff40b71703375052e918da177abdc0f9
+  data.tar.gz: e1fd936257b35075a3ec67803ba80f31289e16f63234033472d2ec747a701fbe
 SHA512:
-  metadata.gz: 5e8238b7e4f003580db44a1a644c05182487de4a3df691fc79e94fdd5c54508e65735275b364d5e3bbbf6f6e85cce5ad258ab300c83b676da5eb24fe0ce339d7
-  data.tar.gz: 92d509308e9b55f714ff81b5233e879b955c1106b458a79783d8b984ae3c46267ef5b435a132f722003aa1ebfb9cfaa54738b50617d494aab9c5d666d84eddaf
+  metadata.gz: 075bb0545a86778dddd1acd42d7e19868e76c40abeb091c1208cf0bf64725fb03414ffff35b0ff1502a64417429373f748cfe2f44067956e6697f40920a95b5f
+  data.tar.gz: d1fe6c675071d0d90095e14272d5f388960c29b2209077186651d5a28c042147fb7cbd4dc7e7964d48e50cc9fadeef62c585b1fbe69878183dfd75227d3e26c2

data/lib/twilio-ruby/security/request_validator.rb

@@ -25,16 +25,25 @@ module Twilio
       #
       # @return [Boolean] whether or not the computed signature matches the signature parameter
       def validate(url, params, signature)
+        parsed_url = URI(url)
+        url_with_port = add_port(parsed_url)
+        url_without_port = remove_port(parsed_url)
+
+        valid_body = true # default succeed, since body not always provided
         params_hash = body_or_hash(params)
-        if params_hash.is_a? Enumerable
-          expected = build_signature_for(url, params_hash)
-          secure_compare(expected, signature)
-        else
-          expected_signature = build_signature_for(url, {})
-          body_hash = URI.decode_www_form(URI(url).query).to_h['bodySHA256']
-          expected_hash = build_hash_for(params)
-          secure_compare(expected_signature, signature) && secure_compare(expected_hash, body_hash)
+        unless params_hash.is_a? Enumerable
+          body_hash = URI.decode_www_form(parsed_url.query).to_h['bodySHA256']
+          params_hash = build_hash_for(params)
+          valid_body = !(params_hash.nil? || body_hash.nil?) && secure_compare(params_hash, body_hash)
+          params_hash = {}
         end
+
+        # Check signature of the url with and without port numbers
+        # since signature generation on the back end is inconsistent
+        valid_signature_with_port = secure_compare(build_signature_for(url_with_port, params_hash), signature)
+        valid_signature_without_port = secure_compare(build_signature_for(url_without_port, params_hash), signature)
+
+        valid_body && (valid_signature_with_port || valid_signature_without_port)
       end
 
       ##
@@ -92,6 +101,50 @@ module Twilio
           params_or_body
         end
       end
+
+      ##
+      # Adds the standard port to the url if it doesn't already have one
+      #
+      # @param [URI] parsed_url The parsed request url
+      #
+      # @return [String] The URL with a port number
+      def add_port(parsed_url)
+        if parsed_url.port.nil? || parsed_url.port == parsed_url.default_port
+          build_url_with_port_for(parsed_url)
+        else
+          parsed_url.to_s
+        end
+      end
+
+      ##
+      # Removes the port from the url
+      #
+      # @param [URI] parsed_url The parsed request url
+      #
+      # @return [String] The URL without a port number
+      def remove_port(parsed_url)
+        parsed_url.port = nil
+        parsed_url.to_s
+      end
+
+      ##
+      # Builds the url from its component pieces, with the standard port
+      #
+      # @param [URI] parsed_url The parsed request url
+      #
+      # @return [String] The URL with the standard port number
+      def build_url_with_port_for(parsed_url)
+        url = ''
+
+        url += parsed_url.scheme ? "#{parsed_url.scheme}://" : ''
+        url += parsed_url.userinfo ? "#{parsed_url.userinfo}@" : ''
+        url += parsed_url.host ? "#{parsed_url.host}:#{parsed_url.port}" : ''
+        url += parsed_url.path
+        url += parsed_url.query ? "?#{parsed_url.query}" : ''
+        url += parsed_url.fragment ? "##{parsed_url.fragment}" : ''
+
+        url
+      end
     end
   end
 end

data/lib/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module TwilioRubyAuthenticateWebhooks
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: twilio-ruby-authenticate-webhooks
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Erik Griffin
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-10-25 00:00:00.000000000 Z
+date: 2019-10-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler