fix: X-Twilio-Signature validation when URL query parameters contain @ or : (#621)

adamj9431 · web-flow · commit 528fc25c161b · 2020-11-05T13:37:39.000-06:00
diff --git a/lib/webhooks/webhooks.js b/lib/webhooks/webhooks.js
@@ -163,6 +163,8 @@ function validateExpressRequest(request, authToken, opts) {
     });
     if (request.originalUrl.search(/\?/) >= 0) {
       webhookUrl = webhookUrl.replace(/%3F/g, '?');
+      webhookUrl = webhookUrl.replace(/%3A/g, ':');
+      webhookUrl = webhookUrl.replace(/%40/g, '@');
     }
 
   }

Original file line number	Diff line number	Diff line change
`@@ -163,6 +163,8 @@ function validateExpressRequest(request, authToken, opts) {`
`163`	`163`	`});`
`164`	`164`	`if (request.originalUrl.search(/\?/) >= 0) {`
`165`	`165`	`webhookUrl = webhookUrl.replace(/%3F/g, '?');`
	`166`	`+ webhookUrl = webhookUrl.replace(/%3A/g, ':');`
	`167`	`+ webhookUrl = webhookUrl.replace(/%40/g, '@');`
`166`	`168`	`}`
`167`	`169`
`168`	`170`	`}`