box-node-sdk 1.36.0 → 1.37.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## Next Release
+
+**New Features and Enhancements:**
+
+- Add support for copyInstanceOnItemCopy field for metadata templates ([#572](https://github.com/box/box-node-sdk/pull/572))
+
+**Bug Fixes:**
+
+- Fix webhook signature validation ([#568](https://github.com/box/box-node-sdk/pull/568))
+- Update dependencies to patch security vulnerabilities ([#578](https://github.com/box/box-node-sdk/pull/578))
+
 ## 1.36.0 (2020-01-27)
 
 **New Features and Enhancements:**
@@ -163,11 +174,11 @@ to specify a client ID and secret (thanks to @cbetta)
 
 ## 1.16.0 [2018-04-10]
 
-- Added support for [assigning Retention Policies to Metadata Templates](https://github.com/box/box-node-sdk/blob/master/docs/retention-policies.md#assign-retention-policy)
+- Added support for [assigning Retention Policies to Metadata Templates](https://github.com/box/box-node-sdk/blob/main/docs/retention-policies.md#assign-retention-policy)
 
 ## 1.15.0 [2018-03-29]
 
-- Fixed [`client.webhooks.validateMessage() and `sdk.validateWebhookMessage()`](https://github.com/box/box-node-sdk/blob/master/docs/webhooks.md#validate-a-webhook-message)
+- Fixed [`client.webhooks.validateMessage() and `sdk.validateWebhookMessage()`](https://github.com/box/box-node-sdk/blob/main/docs/webhooks.md#validate-a-webhook-message)
 to accept the request body as an `Object`
 - Fixed `sdk.configure()` to correct reconfigure all options
 - Improved error messages for API errors and added the request object as `error.request` for easier debugging

package/README.md

@@ -184,7 +184,7 @@ client.comments.delete('456')
 
 For complete documentation about the available operations, please see
 the [SDK documentation pages](./docs) and the auto-generated
-[JSDocs](https://rawgit.com/box/box-node-sdk/master/docs/jsdoc/index.html).
+[JSDocs](https://rawgit.com/box/box-node-sdk/main/docs/jsdoc/index.html).
 These contain detailed information about which methods are available and
 how to use them.
 

package/lib/managers/metadata.js

@@ -148,6 +148,7 @@ Metadata.prototype = {
 	 * @param {string} [options.templateKey] - The programmatic key for the template
 	 * @param {boolean} [options.hidden] - Whether the template should be hidden in the UI
 	 * @param {string} [options.scope=enterprise] - The scope for the template, only 'enterprise' is supported for now
+	 * @param {boolean} [options.copyInstanceOnItemCopy] - Whether to include the metadata when a file or folder is copied
 	 * @param {Function} [callback] - Passed the template if successful, error otherwise
 	 * @returns {Promise<Object>} A promise resolving to the created template
 	 */

package/lib/managers/webhooks.js

@@ -110,6 +110,17 @@ function validateDeliveryTimestamp(headers, maxMessageAge) {
 	return true;
 }
 
+/**
+ * Stringify JSON with escaped multibyte Unicode characters to ensure computed signatures match PHP's default behavior
+ *
+ * @param {Object} body - The parsed JSON object
+ * @returns {string} - Stringified JSON with escaped multibyte Unicode characters
+ * @private
+ */
+function jsonStringifyWithEscapedUnicode(body) {
+	return JSON.stringify(body).replace(/[\u007f-\uffff]/g, char => `\\u${`0000${char.charCodeAt(0).toString(16)}`.slice(-4)}`);
+}
+
 // -----------------------------------------------------------------------------
 // Public
 // -----------------------------------------------------------------------------
@@ -351,7 +362,8 @@ Webhooks.validateMessage = function(body, headers, primaryKey, secondaryKey, max
 	// For frameworks like Express that automatically parse JSON
 	// bodies into Objects, re-stringify for signature testing
 	if (typeof body === 'object') {
-		body = JSON.stringify(body);
+		// Escape forward slashes to ensure a matching signature
+		body = jsonStringifyWithEscapedUnicode(body).replace(/\//g, '\\/');
 	}
 
 	if (!validateSignature(body, headers, primaryKey, secondaryKey)) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "box-node-sdk",
   "author": "Box <oss@box.com>",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "Official SDK for Box Plaform APIs",
   "license": "Apache-2.0",
   "repository": {
@@ -59,7 +59,7 @@
     "nock": "^9.6.1",
     "np": "^7.2.0",
     "npm-force-resolutions": "0.0.3",
-    "npm-upgrade": "^2.0.3",
+    "npm-upgrade": "^3.0.0",
     "nyc": "^14.0.0",
     "shelljs": "^0.8.3",
     "shelljs-nodecli": "^0.1.1",