wingbot 3.76.15 → 3.76.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wingbot",
-  "version": "3.76.15",
+  "version": "3.76.16",
   "description": "Enterprise Messaging Bot Conversation Engine",
   "main": "index.js",
   "type": "commonjs",

package/src/Processor.js

@@ -116,6 +116,7 @@ const LLMDispatcher = require('./LLMDispatcher');
  * @prop {number} [sessionDuration] - Session duration for analytic purposes
  * @prop {LLMGlobalConfig} [llm] - LLM model configuration
  * @prop {Preloader<R>} [preloader]
+ * @prop {string[]} [allowedPostBacks]
  */
 
 /**
@@ -208,7 +209,8 @@ class Processor extends EventEmitter {
             autoSeen: false,
             redirectLimit: 20,
             nameFromState: NAME_FROM_STATE,
-            sessionDuration: 1800000 // 30 minutes
+            sessionDuration: 1800000, // 30 minutes,
+            allowedPostBacks: []
         };
 
         Object.assign(this.options, options);
@@ -657,6 +659,19 @@ class Processor extends EventEmitter {
                 configuration
             );
 
+            const reqActionNorm = req.action()?.replace(/^\/?/, '/');
+            if (req.isPostBack()
+                && fromEvent
+                && reqActionNorm
+                && this.options.allowedPostBacks.length > 0
+                && !this.options.allowedPostBacks.some((pb) => {
+                    const norm = pb.replace(/^\/?/, '/');
+                    return norm === reqActionNorm;
+                })) {
+
+                throw Object.assign(new Error(`Invalid postback error "${req.action()}"`), { code: 400 });
+            }
+
             // process session
             if (fromEvent) {
                 let {