added request validation for urls with and without ports

lib/webhooks/webhooks.js

@@ -3,7 +3,51 @@
 var crypto = require('crypto');
 var _ = require('lodash');
 var scmp = require('scmp');
-var url = require('url');
+var urllib = require('url');
+
+/**
+ * Utility function to construct the URL string, since Node.js url library won't include standard port numbers
+ *
+ * @param {URL} parsedUrl - The parsed url object that Twilio requested on your server
+ * @returns {string} - URL with standard port number included
+ */
+function buildUrlWithStandardPort(parsedUrl) {
+  let url = '';
+  const port = parsedUrl.protocol === 'https:' ? ':443' : ':80';
+
+  url += parsedUrl.protocol ? parsedUrl.protocol + '//' : '';
+  url += parsedUrl.username;
+  url += parsedUrl.password ? ':' + parsedUrl.password : '';
+  url += (parsedUrl.username || parsedUrl.password) ? '@' : '';
+  url += parsedUrl.host ? parsedUrl.host + port : '';
+  url += parsedUrl.pathname + parsedUrl.search + parsedUrl.hash;
+
+  return url;
+}
+
+/**
+ Utility function to add a port number to a URL
+
+ @param {URL} parsedUrl - The parsed url object that Twilio requested on your server
+ @returns {string} - URL with port
+ */
+function addPort(parsedUrl) {
+  if (!parsedUrl.port) {
+    return buildUrlWithStandardPort(parsedUrl);
+  }
+  return parsedUrl.toString();
+}
+
+/**
+ Utility function to remove a port number from a URL
+
+ @param {URL} parsedUrl - The parsed url object that Twilio requested on your server
+ @returns {string} - URL without port
+ */
+function removePort(parsedUrl) {
+  parsedUrl.port = '';
+  return parsedUrl.toString();
+}
 
 /**
  Utility function to get the expected signature for a given request
@@ -18,7 +62,7 @@ function getExpectedTwilioSignature(authToken, url, params) {
   var data = Object.keys(params)
     .sort()
     .reduce((acc, key) => acc + key + params[key], url);
-  
+
   return crypto
     .createHmac('sha1', authToken)
     .update(Buffer.from(data, 'utf-8'))
@@ -48,8 +92,25 @@ function getExpectedBodyHash(body) {
  */
 function validateRequest(authToken, twilioHeader, url, params) {
   twilioHeader = twilioHeader || '';
-  var expectedSignature = getExpectedTwilioSignature(authToken, url, params);
-  return scmp(Buffer.from(twilioHeader), Buffer.from(expectedSignature));
+  const urlObject = new urllib.URL(url);
+  const urlWithPort = addPort(urlObject);
+  const urlWithoutPort = removePort(urlObject);
+
+  /*
+   *  Check signature of the url with and without the port number
+   *  since signature generation on the back end is inconsistent
+   */
+  const signatureWithPort = getExpectedTwilioSignature(authToken, urlWithPort, params);
+  const signatureWithoutPort = getExpectedTwilioSignature(authToken, urlWithoutPort, params);
+  const validSignatureWithPort = scmp(Buffer.from(twilioHeader), Buffer.from(signatureWithPort));
+  const validSignatureWithoutPort = scmp(Buffer.from(twilioHeader), Buffer.from(signatureWithoutPort));
+
+  return validSignatureWithoutPort || validSignatureWithPort;
+}
+
+function validateBody(body, bodyHash) {
+  var expectedHash = getExpectedBodyHash(body);
+  return scmp(Buffer.from(bodyHash), Buffer.from(expectedHash));
 }
 
 /**
@@ -58,18 +119,14 @@ function validateRequest(authToken, twilioHeader, url, params) {
 
  @param {string} authToken - The auth token, as seen in the Twilio portal
  @param {string} twilioHeader - The value of the X-Twilio-Signature header from the request
- @param {string} requestUrl - The full URL (with query string) you configured to handle this request
+ @param {string} url - The full URL (with query string) you configured to handle this request
  @param {string} body - The body of the request
  @returns {boolean} - valid
  */
-function validateRequestWithBody(authToken, twilioHeader, requestUrl, body) {
-  var urlObject = new url.URL(requestUrl);
-  return validateRequest(authToken, twilioHeader, requestUrl, {}) && validateBody(body, urlObject.searchParams.get('bodySHA256'));
-}
-
-function validateBody(body, bodyHash) {
-  var expectedHash = getExpectedBodyHash(body);
-  return scmp(Buffer.from(bodyHash), Buffer.from(expectedHash));
+function validateRequestWithBody(authToken, twilioHeader, url, body) {
+  const urlObject = new urllib.URL(url);
+  return validateRequest(authToken, twilioHeader, url, {}) &&
+    validateBody(body, urlObject.searchParams.get('bodySHA256'));
 }
 
 /**
@@ -95,7 +152,7 @@ function validateExpressRequest(request, authToken, opts) {
     var protocol = options.protocol || request.protocol;
     var host = options.host || request.headers.host;
 
-    webhookUrl = url.format({
+    webhookUrl = urllib.format({
         protocol: protocol,
         host: host,
         pathname: request.originalUrl

spec/validation.spec.js

@@ -75,6 +75,61 @@ describe('Request validation', () => {
 
         expect(isValid).toBeFalsy();
     });
+
+    it('should validate https urls with ports by stripping them', () => {
+        const requestUrlWithPort = requestUrl.replace('.com', '.com:1234');
+        const isValid = validateRequest(token, defaultSignature, requestUrlWithPort, defaultParams);
+
+        expect(isValid).toBeTruthy();
+    });
+
+    it('should validate http urls with ports', () => {
+        let requestUrlWithPort = requestUrl.replace('.com', '.com:1234');
+        requestUrlWithPort = requestUrlWithPort.replace('https', 'http');
+        const signature =  'Zmvh+3yNM1Phv2jhDCwEM3q5ebU='; // hash of http url with port 1234
+        const isValid = validateRequest(token, signature, requestUrlWithPort, defaultParams);
+
+        expect(isValid).toBeTruthy();
+    });
+
+    it('should validate https urls without ports by adding standard port 443', () => {
+        const signature =  'kvajT1Ptam85bY51eRf/AJRuM3w=';  // hash of https url with port 443
+        const isValid = validateRequest(token, signature, requestUrl, defaultParams);
+
+        expect(isValid).toBeTruthy();
+    });
+
+    it('should validate http urls without ports by adding standard port 80', () => {
+        const requestUrlHttp = requestUrl.replace('https', 'http');
+        const signature =  '0ZXoZLH/DfblKGATFgpif+LLRf4=';  // hash of http url with port 80
+        const isValid = validateRequest(token, signature, requestUrlHttp, defaultParams);
+
+        expect(isValid).toBeTruthy();
+    });
+
+    it('should validate urls with credentials', () => {
+        const urlWithCreds = 'https://user:[email protected]/myapp.php?foo=1&bar=2';
+        const signature = 'CukzLTc1tT5dXEDIHm/tKBanW10='; // hash of this url
+        const isValid = validateRequest(token, signature, urlWithCreds, defaultParams);
+
+        expect(isValid).toBeTruthy();
+    });
+
+    it('should validate urls with just username', () => {
+        const urlWithCreds = 'https://[email protected]/myapp.php?foo=1&bar=2';
+        const signature = '2YRLlVAflCqxaNicjMpJcSTgzSs='; // hash of this url
+        const isValid = validateRequest(token, signature, urlWithCreds, defaultParams);
+
+        expect(isValid).toBeTruthy();
+    });
+
+    it('should validate urls with credentials by adding port', () => {
+        const urlWithCreds = 'https://user:[email protected]/myapp.php?foo=1&bar=2';
+        const signature = 'ZQFR1PTIZXF2MXB8ZnKCvnnA+rI='; // hash of this url with port 443
+        const isValid = validateRequest(token, signature, urlWithCreds, defaultParams);
+
+        expect(isValid).toBeTruthy();
+    });
 });
 
 describe('Request validation middleware', () => {