@octokit/webhooks - npm Package Compare versions

Comparing version 11.0.0-beta.4 to 11.0.0-beta.5

dist-node/index.js

@@ -160,16 +160,2 @@ 'use strict';
 
-/**
- * GitHub sends its JSON with no indentation and no line break at the end
- */
-function toNormalizedJsonString(payload) {
-  const payloadString = JSON.stringify(payload);
-  return payloadString.replace(/[^\\]\\u[\da-f]{4}/g, s => {
-    return s.substr(0, 3) + s.substr(3).toUpperCase();
-  });
-}
-
-async function sign(secret, payload) {
-  return webhooksMethods.sign(secret, typeof payload === "string" ? payload : toNormalizedJsonString(payload));
-}
-
 async function verifyAndReceive(state, event) {
@@ -251,2 +237,15 @@ // verify will validate that the secret is not undefined
   }
+  // Check if the Content-Type header is `application/json` and allow for charset to be specified in it
+  // Otherwise, return a 415 Unsupported Media Type error
+  // See https://github.com/octokit/webhooks.js/issues/158
+  if (!request.headers["content-type"].startsWith("application/json")) {
+    response.writeHead(415, {
+      "content-type": "application/json",
+      accept: "application/json"
+    });
+    response.end(JSON.stringify({
+      error: `Unsupported "Content-Type" header value. Must be "application/json"`
+    }));
+    return true;
+  }
   const missingHeaders = getMissingHeaders(request).join(", ");
@@ -322,3 +321,3 @@ if (missingHeaders) {
     };
-    this.sign = sign.bind(null, options.secret);
+    this.sign = webhooksMethods.sign.bind(null, options.secret);
     this.verify = webhooksMethods.verify.bind(null, options.secret);
@@ -325,0 +324,0 @@ this.on = state.eventHandler.on;

dist-src/index.js

 import { createLogger } from "./createLogger";
 import { createEventHandler } from "./event-handler/index";
-import { sign } from "./sign";
-import { verify } from "@octokit/webhooks-methods";
+import { sign, verify } from "@octokit/webhooks-methods";
 import { verifyAndReceive } from "./verify-and-receive";
@@ -6,0 +5,0 @@ export { createNodeMiddleware } from "./middleware/node/index";

dist-src/middleware/node/middleware.js

@@ -26,2 +26,15 @@ import { getMissingHeaders } from "./get-missing-headers";
     }
+    // Check if the Content-Type header is `application/json` and allow for charset to be specified in it
+    // Otherwise, return a 415 Unsupported Media Type error
+    // See https://github.com/octokit/webhooks.js/issues/158
+    if (!request.headers["content-type"].startsWith("application/json")) {
+        response.writeHead(415, {
+            "content-type": "application/json",
+            accept: "application/json",
+        });
+        response.end(JSON.stringify({
+            error: `Unsupported "Content-Type" header value. Must be "application/json"`,
+        }));
+        return true;
+    }
     const missingHeaders = getMissingHeaders(request).join(", ");
@@ -28,0 +41,0 @@ if (missingHeaders) {

dist-types/index.d.ts

@@ -6,3 +6,3 @@ import { createEventHandler } from "./event-handler/index";
 declare class Webhooks<TTransformed = unknown> {
-    sign: (payload: string | object) => Promise<string>;
+    sign: (payload: string) => Promise<string>;
     verify: (eventPayload: string, signature: string) => Promise<boolean>;
@@ -9,0 +9,0 @@ on: <E extends EmitterWebhookEventName>(event: E | E[], callback: HandlerFunction<E, TTransformed>) => void;

dist-web/index.js

 import AggregateError from 'aggregate-error';
-import { sign as sign$1, verify } from '@octokit/webhooks-methods';
+import { verify, sign } from '@octokit/webhooks-methods';
 
@@ -410,16 +410,2 @@ const createLogger = (logger) => ({
 
-/**
- * GitHub sends its JSON with no indentation and no line break at the end
- */
-function toNormalizedJsonString(payload) {
-    const payloadString = JSON.stringify(payload);
-    return payloadString.replace(/[^\\]\\u[\da-f]{4}/g, (s) => {
-        return s.substr(0, 3) + s.substr(3).toUpperCase();
-    });
-}
-
-async function sign(secret, payload) {
-    return sign$1(secret, typeof payload === "string" ? payload : toNormalizedJsonString(payload));
-}
-
 async function verifyAndReceive(state, event) {
@@ -506,2 +492,15 @@ // verify will validate that the secret is not undefined
     }
+    // Check if the Content-Type header is `application/json` and allow for charset to be specified in it
+    // Otherwise, return a 415 Unsupported Media Type error
+    // See https://github.com/octokit/webhooks.js/issues/158
+    if (!request.headers["content-type"].startsWith("application/json")) {
+        response.writeHead(415, {
+            "content-type": "application/json",
+            accept: "application/json",
+        });
+        response.end(JSON.stringify({
+            error: `Unsupported "Content-Type" header value. Must be "application/json"`,
+        }));
+        return true;
+    }
     const missingHeaders = getMissingHeaders(request).join(", ");
@@ -508,0 +507,0 @@ if (missingHeaders) {

package.json

 {
   "name": "@octokit/webhooks",
   "description": "GitHub webhook events toolset for Node.js",
-  "version": "11.0.0-beta.4",
+  "version": "11.0.0-beta.5",
   "license": "MIT",
@@ -6,0 +6,0 @@ "files": [

README.md

@@ -165,3 +165,3 @@ # @octokit/webhooks
         <em>
-          (Object)
+          (String)
         </em>
@@ -696,3 +696,3 @@ </td>
 
-The types for the webhook payloads are sourced from [`@octokit/webhooks-types`](https://github.com/octokit/webhooks/tree/master/payload-types),
+The types for the webhook payloads are sourced from [`@octokit/webhooks-types`](https://github.com/octokit/webhooks/tree/main/payload-types),
 which can be used by themselves.
@@ -699,0 +699,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

193116

decreased by-0.29%

Number of package files

39

decreased by-9.3%

Lines of code

1657

decreased by-0.3%

No dependency changes