@3846masa/linebot - npm Package Compare versions

Comparing version 0.2.0 to 0.2.1

lib/LineBot/index.js

@@ -128,6 +128,6 @@ 'use strict';
 
-        const hmac = (0, _crypto.createHmac)('sha256', this.config.channelSecret);
-        hmac.update(body);
-        const calcResult = hmac.digest('base64');
-        return calcResult === signature;
+        const hmac = (0, _crypto.createHmac)('sha256', this.config.channelSecret).update(body).digest('base64');
+        const hmacHashed = (0, _crypto.createHash)('sha1').update(hmac).digest();
+        const signatureHashed = (0, _crypto.createHash)('sha1').update(signature).digest();
+        return hmacHashed.equals(signatureHashed);
     }
@@ -134,0 +134,0 @@ /**

package.json

 {
   "name": "@3846masa/linebot",
   "description": "LINE BOT API wrapper for Node.js",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": "3846masa <[e-mail]>",
@@ -6,0 +6,0 @@ "bugs": {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

74394

increased by0.18%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes