waha-ruby 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc9414c7b9bb51ef5a2e118d72f6b0d33bc099b91ea8b705a11f6c17d63ca7ac
-  data.tar.gz: 8fa5cba6397385326900b0d420a45fb2029c33350205c038046f0fd314588540
+  metadata.gz: b6143fc09b5ea2bfb45b55cba490a5b2f4b2527800991e8207f9f838c363998f
+  data.tar.gz: e740e63e91ffadba7ee5919d36722f973847c86818c244753535f98dca9cd70d
 SHA512:
-  metadata.gz: 69d17352f8e08d07e2d86948a31c7079ff7cdacb7b9bca0ac91f72a292caa6eb50e5f7c9a9ba90d4b7b4886cc3ba7683a544176a77c1f56e9de643c6852e935a
-  data.tar.gz: 29707e3dfac2eca128adc7ab801e5e062d523944a32db35d0500870fb46b4dfcedeb2c6523828108a0dc556735b91e129bcf1a60d6e6e17c3e176335773ac7f4
+  metadata.gz: 63f59ffd2b58f82e9ca8e925b5e8c07958e8e508f12a1df49c73cc9ffaf3311b7be6546632d988b987ac35cd11169bfe9effd2896642763a371501a6e04a2462
+  data.tar.gz: 4dee276f3bbfbb301a9f4beaa499c92e0bbba61ada941acef1487bcbe041539f21746f071679b8359044bb11d97a8761905ff06d37cc5b64cf3353b8001f39ec

data/.rubocop.yml

@@ -30,12 +30,12 @@ Metrics/ClassLength:
 Metrics/ParameterLists:
   Exclude:
     - "lib/waha/resources/messages.rb"
-    - "lib/waha/transport/http_party.rb"
+    - "lib/waha/transport/faraday.rb"
 
 Metrics/AbcSize:
   Exclude:
     - "lib/waha/resources/messages.rb"
-    - "lib/waha/transport/http_party.rb"
+    - "lib/waha/transport/faraday.rb"
 
 Layout/LineLength:
   Exclude:

data/CHANGELOG.md

@@ -8,6 +8,20 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Fixed
+
+- `Waha::Webhook.verify!` fails closed when the secret is nil, empty, or
+  blank, preventing signature forgery against unconfigured consumers.
+- Webhook comparison delegates to `OpenSSL.secure_compare` for native
+  constant-time comparison.
+- `Waha::Resources::Media#download` only accepts media URLs served by the
+  configured WAHA host; all loopback origins (`localhost`, `127.0.0.1`,
+  `::1`) rebase to the base URL, closing an SSRF and API-key exfiltration
+  vector.
+- `Waha::Resources::Webhooks` deep duplication uses identity-based
+  memoization so value-equal config entries no longer alias each other.
+- Chats message query keyword `last_message_id` maps to `lastMessageId`.
+
 ## [0.1.0] - 2026-09-09
 
 ### Added

data/lib/waha/resources/media.rb

@@ -6,6 +6,7 @@ module Waha
   module Resources
     class Media < Resource
       DOWNLOAD_TIMEOUT = 60
+      LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
 
       def initialize(transport:, base_url:)
         super(transport:, session: nil)
@@ -36,19 +37,26 @@ module Waha
           raise ValidationError.new(operation: "download_media", details: "unsupported media URL scheme")
         end
 
-        return uri.to_s unless uri.host == "localhost"
+        return rebase_to_base_url(uri) if LOOPBACK_HOSTS.include?(uri.host)
 
-        rebase_to_base_url(uri)
+        unless uri.host == base_uri.host
+          raise ValidationError.new(operation: "download_media", details: "media URL host is not the WAHA server")
+        end
+
+        uri.to_s
       end
 
       def rebase_to_base_url(uri)
-        base_uri = URI.parse(@base_url)
         uri.scheme = base_uri.scheme
         uri.host = base_uri.host
         uri.port = base_uri.port
         uri.to_s
       end
 
+      def base_uri
+        @base_uri ||= URI.parse(@base_url.to_s)
+      end
+
       def parse_uri(url)
         text = url.to_s
         uri = URI.parse(text)

data/lib/waha/resources/webhooks.rb

@@ -63,7 +63,7 @@ module Waha
         Support.value(session_data, "name") || fallback
       end
 
-      def deep_dup(value, seen = {})
+      def deep_dup(value, seen = {}.compare_by_identity)
         return value unless value.is_a?(Hash) || value.is_a?(Array)
         return seen[value] if seen.key?(value)
 

data/lib/waha/support.rb

@@ -21,7 +21,7 @@ module Waha
       sort_by: "sortBy",
       sort_order: "sortOrder",
       last_message_timestamp: "lastMessageTimestamp",
-      last_message_lid: "lastMessageId",
+      last_message_id: "lastMessageId",
       contact_id: "contactId",
       phone_number: "phoneNumber"
     }.freeze

data/lib/waha/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Waha
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/lib/waha/webhook.rb

@@ -9,10 +9,14 @@ module Waha
     module_function
 
     def verify!(body:, signature:, algorithm:, secret:)
+      if secret.to_s.strip.empty?
+        raise VerificationError.new(operation: "verify_webhook", details: "secret is required")
+      end
+
       verify_algorithm!(algorithm)
       signature_text = verified_signature_text(signature)
       expected = OpenSSL::HMAC.hexdigest(DIGEST, secret.to_s, body.to_s)
-      return true if secure_compare?(signature_text, expected)
+      return true if OpenSSL.secure_compare(signature_text, expected)
 
       raise VerificationError.new(operation: "verify_webhook", details: "signature mismatch")
     end
@@ -32,18 +36,5 @@ module Waha
       raise VerificationError.new(operation: "verify_webhook", details: "malformed signature")
     end
     private_class_method :verified_signature_text
-
-    def secure_compare?(signature, expected)
-      signature.bytesize == expected.bytesize && secure_bytes_equal?(signature, expected)
-    end
-    private_class_method :secure_compare?
-
-    def secure_bytes_equal?(left, right)
-      left_bytes = left.unpack("C*")
-      right_bytes = right.unpack("C*")
-      comparison = left_bytes.zip(right_bytes).reduce(0) { |result, pair| result | (pair[0] ^ pair[1]) }
-      comparison.zero?
-    end
-    private_class_method :secure_bytes_equal?
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: waha-ruby
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Mauricio Zaffari
@@ -251,7 +251,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/develoz-com/waha-ruby
-  source_code_uri: https://github.com/develoz-com/waha-ruby/tree/v0.1.0
+  source_code_uri: https://github.com/develoz-com/waha-ruby/tree/v0.1.1
   changelog_uri: https://github.com/develoz-com/waha-ruby/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []