Verify Slack webhook tokens #776
Conversation
Signed-off-by: Tadeusz „tadzik” Sośnierz <[email protected]>
Signed-off-by: Tadeusz „tadzik” Sośnierz <[email protected]>
src/SlackHookHandler.ts
Outdated
| @@ -85,7 +85,7 @@ export class SlackHookHandler extends BaseSlackHandler { | |||
| } | |||
| } | |||
|
|
|||
| private onRequest(req: IncomingMessage, res: ServerResponse) { | |||
| public _onRequest(req: IncomingMessage, res: ServerResponse) { | |||
There was a problem hiding this comment.
This seems quite cheeky. If you're mocking stuff, why not hookHandler["onRequest"] to get around the public/private check.
There was a problem hiding this comment.
Getting around the check seems dirtier to me, to be honest. I won't fight for it though, I'm fine with either.
src/SlackHookHandler.ts
Outdated
| @@ -67,7 +67,7 @@ export class SlackHookHandler extends BaseSlackHandler { | |||
| createServer = (cb) => httpsCreate(tlsOptions, cb); | |||
| } | |||
| return new Promise<void>((resolve, reject) => { | |||
| const srv = createServer(this.onRequest.bind(this)); | |||
| const srv = createServer(this._onRequest.bind(this)); | |||
There was a problem hiding this comment.
Not a huge fan of the underscore prefix, smells like snakes
There was a problem hiding this comment.
Changed in 2d97794?diff=unified&w=1
tests/integration/WebhookTest.ts
Outdated
| let room = new BridgedRoom(harness.main as unknown as Main, { | ||
| matrix_room_id: '!foo:bar.baz', | ||
| inbound_id: randomstring.generate(32), | ||
| slack_webhook_token: randomstring.generate(24), |
There was a problem hiding this comment.
What about no token at all :). Or null, or true etc etc :)
There was a problem hiding this comment.
Added a few more in tadzik@4d312a3?diff=unified&w=1 :)
| @@ -0,0 +1 @@ | |||
| Verify Slack webhook tokens. | |||
There was a problem hiding this comment.
I figured bugfix is the closest this comes to, since it was arguably a bug that we never did this before.
This will unfortunately require relinking all existing channels that use webhooks.
I pondered making this optional, but in the spirit of being secure by default, it's probably best if we mandate this.
Existing rooms will have to be unlinked and linked again (or have their database entries updated manually).
This also increases SlackHookHandler's test coverage by ~18% (from 9.39% to 27.51%) :)