@slack/interactive-messages - npm Package Compare versions

Comparing version 1.2.0 to 1.3.0

dist/adapter.js

@@ -207,8 +207,3 @@ "use strict";
         var requestListener = this.requestListener();
-        return function (req, res, next) {
-            // If parser is being used, we can't verify request signature
-            if (!util_1.isFalsy(req.body)) {
-                next(errors_1.errorWithCode(new Error('Parsing request body prohibits request signature verification'), errors_1.ErrorCode.BodyParserNotPermitted));
-                return;
-            }
+        return function (req, res, _next) {
             requestListener(req, res);
@@ -215,0 +210,0 @@ };

dist/http-handler.d.ts

 /// <reference types="node" />
-import { RequestListener, IncomingHttpHeaders } from 'http';
+import { ServerResponse, IncomingHttpHeaders, IncomingMessage } from 'http';
 import SlackMessageAdapter from './adapter';
-export declare function createHTTPHandler(adapter: SlackMessageAdapter): RequestListener;
+export declare function createHTTPHandler(adapter: SlackMessageAdapter): HTTPHandler;
 /**
+ * A RequestListener-compatible callback for creating response information from an incoming request.
+ *
+ * @remarks
+ * See RequestListener in the `http` module.
+ */
+declare type HTTPHandler = (req: IncomingMessage & {
+    body?: any;
+    rawBody?: Buffer;
+}, res: ServerResponse) => void;
+/**
  * Headers required for verification.
@@ -14,2 +24,3 @@ *
 }
+export {};
 //# sourceMappingURL=http-handler.d.ts.map

dist/http-handler.js

@@ -77,3 +77,3 @@ "use strict";
             debug('request is older than 5 minutes');
-            throw errors_1.errorWithCode(new Error('Slack request signing verification failed'), errors_1.ErrorCode.RequestTimeFailure);
+            throw errors_1.errorWithCode(new Error('Slack request signing verification outdated'), errors_1.ErrorCode.RequestTimeFailure);
         }
@@ -98,4 +98,27 @@ var hmac = crypto_1.default.createHmac('sha256', signingSecret);
         var respond = sendResponse(res);
-        // Builds body of the request from stream and returns the raw request body
-        raw_body_1.default(req)
+        // If parser is being used and we don't receive the raw payload via `rawBody`,
+        // we can't verify request signature
+        if (!util_1.isFalsy(req.body) && util_1.isFalsy(req.rawBody)) {
+            respond({
+                status: 500,
+                content: process.env.NODE_ENV === 'development'
+                    ? 'Parsing request body prohibits request signature verification'
+                    : undefined,
+            });
+            return;
+        }
+        // Some serverless cloud providers (e.g. Google Firebase Cloud Functions) might populate
+        // the request with a bodyparser before it can be populated by the SDK.
+        // To prevent throwing an error here, we check the `rawBody` field before parsing the request
+        // through the `raw-body` module (see Issue #85 - https://github.com/slackapi/node-slack-events-api/issues/85)
+        var parseRawBody;
+        if (!util_1.isFalsy(req.rawBody)) {
+            debug('Parsing request with a rawBody attribute');
+            parseRawBody = Promise.resolve(req.rawBody);
+        }
+        else {
+            debug('Parsing raw request');
+            parseRawBody = raw_body_1.default(req);
+        }
+        parseRawBody
             .then(function (bodyBuf) {
@@ -102,0 +125,0 @@ var rawBody = bodyBuf.toString();

package.json

 {
   "name": "@slack/interactive-messages",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Official library for using the Slack Platform's Interactive Buttons, Menus, Dialogs, Actions, and Block Actions",
@@ -86,3 +86,3 @@ "author": "Slack Technologies, Inc.",
   },
-  "gitHead": "35b40af1dc28ef40cb00eb9a47f902e73c27b03f"
+  "gitHead": "3a0e06381d632bb6aae74016c45158e962d15ea5"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

98612

increased by1.7%

Lines of code

1048

increased by2.85%

Number of medium supply chain risk alerts

1

decreased by-50%

Worsened metrics

Number of low supply chain risk alerts

3

increased by50%

No dependency changes