
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@twilio-labs/plugin-webhook
Advanced tools
Plugin for the Twilio CLI to test your Twilio webhooks and TwiML Bins.
This plugin adds functionality to the Twilio CLI to invoke emulated webhook events including valid X-Twilio-Signature
to validate the webhooks and TwiML Bins you are creating for your Twilio applications.
This tool is a plugin for the Twilio CLI meaning you'll have to first install the Twilio CLI. You can find instructions for a variety of environments in our docs.
If you are using npm
or yarn
for global CLI tools you can run:
npm install -g twilio-cli
yarn global add twilio-cli
$ twilio plugins:install @twilio-labs/plugin-webhook
$ twilio --help webhook
USAGE
$ twilio webhook
...
twilio webhook:invoke URL
Emulate a Twilio webhook request to your URL
USAGE
$ twilio webhook:invoke URL
ARGUMENTS
URL The URL of your webhook
OPTIONS
-X, --method=(GET|POST) [default: POST] The HTTP method that should be used for the webhook request
-d, --data-urlencode=data-urlencode Override a request field. In the format Key=Value. Example: Body=Hello
-i, --include Output additional response data such as response headers
-l=(debug|info|warn|error|none) [default: info] Level of logging messages.
-p, --profile=profile Shorthand identifier for your profile.
--account-sid=account-sid The Account SID to use in the event data. Defaults to your active CLI profile or
otherwise TWILIO_ACCOUNT_SID environment variable.
--auth-token=auth-token The Auth Token to use to generate the X-Twilio-Signature. Required unless
--no-signature is used. Defaults to value of TWILIO_AUTH_TOKEN environment
variable if nothing is passed.
--no-signature Circumvents the generation of the X-Twilio-Signature field
--silent Suppress output and logs. This is a shorthand for "-l none -o none".
--type=(sms|voice) [default: sms] What type of webhook event should it emulate?
EXAMPLES
# Invoke with a simulated call event
twilio webhook:invoke <your-url> --type=voice
# Pass in an explict auth token and Account SID to use
twilio webhook:invoke <your-url> --auth-token=$TWILIO_AUTH_TOKEN --account-sid=$TWILIO_ACCOUNT_SID --type=voice
# Simulate an SMS with the message "Hello"
twilio webhook:invoke <your-url> --auth-token=$TWILIO_AUTH_TOKEN --type=sms -d Body=Hello
# Skip X-Twilio-Signature header generation
twilio webhook:invoke <your-url> --no-signature
# Use Account SID from specific CLI profile
twilio webhook:invoke <your-url> --auth-token=$TWILIO_AUTH_TOKEN -p <your-profile>
See code: src/commands/webhook/invoke.js
We always welcome contributions to this project. To learn more about how to get started, check out our contribution guide.
Please be aware that this project has a Code of Conduct. The tldr; is to just be excellent to each other ❤️
MIT
FAQs
Emulate webhook requests from your commandline
We found that @twilio-labs/plugin-webhook demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.