@slack/events-api - npm Package Compare versions

Comparing version 2.3.3 to 2.3.4

dist/adapter.js

@@ -55,2 +55,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SlackEventAdapter = void 0;
 /* tslint:disable import-name */
@@ -57,0 +58,0 @@ var events_1 = __importDefault(require("events"));

dist/http-handler.js

@@ -13,2 +13,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.errorCodes = exports.ErrorCode = exports.createHTTPHandler = exports.verifyRequestSignature = void 0;
 /* tslint:disable:import-name */
@@ -147,2 +148,6 @@ var debug_1 = __importDefault(require("debug"));
         var respond = sendResponse(res);
+        if (util_1.isFalsy(req.headers['x-slack-signature']) || util_1.isFalsy(req.headers['x-slack-request-timestamp'])) {
+            handleError(errorWithCode(new Error('Slack request signing verification failed'), ErrorCode.SignatureVerificationFailure), respond);
+            return;
+        }
         // If parser is being used and we don't receive the raw payload via `rawBody`,
@@ -149,0 +154,0 @@ // we can't verify request signature

dist/index.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEventAdapter = void 0;
 var adapter_1 = require("./adapter");
 var http_handler_1 = require("./http-handler");
-exports.verifyRequestSignature = http_handler_1.verifyRequestSignature;
-exports.errorCodes = http_handler_1.errorCodes;
+Object.defineProperty(exports, "verifyRequestSignature", { enumerable: true, get: function () { return http_handler_1.verifyRequestSignature; } });
+Object.defineProperty(exports, "errorCodes", { enumerable: true, get: function () { return http_handler_1.errorCodes; } });
 /**
@@ -8,0 +9,0 @@ * Creates a new {@link SlackEventAdapter}.

dist/util.js

@@ -6,2 +6,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isFalsy = exports.packageIdentifier = void 0;
 var os_1 = __importDefault(require("os"));
@@ -8,0 +9,0 @@ var pkg = require('../package.json'); // tslint:disable-line

package.json

 {
   "name": "@slack/events-api",
-  "version": "2.3.3",
+  "version": "2.3.4",
   "description": "Official library for using the Slack Platform's Web API",
@@ -5,0 +5,0 @@ "author": "Slack Technologies, Inc.",

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

57748

increased by1.88%

Lines of code

665

increased by1.22%

Worsened metrics

Number of medium supply chain risk alerts

2

increased by100%

No dependency changes