From 5136b015978c047396953a2d0b557725588d0131 Mon Sep 17 00:00:00 2001
From: Robbie Biesser <Robbie.Biesser@terazo.com>
Date: Sat, 15 Jan 2022 21:10:18 -0500
Subject: [PATCH] fix: webhook validation with array parameter sorting

---
 lib/webhooks/webhooks.js | 1 +
 spec/validation.spec.js  | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/lib/webhooks/webhooks.js b/lib/webhooks/webhooks.js
index dcf07c7cb1..8e19b7453e 100644
--- a/lib/webhooks/webhooks.js
+++ b/lib/webhooks/webhooks.js
@@ -60,6 +60,7 @@ function removePort(parsedUrl) {
 function toFormUrlEncodedParam(paramName, paramValue) {
   if (paramValue instanceof Array) {
     return paramValue
+      .sort()
       .map(val => toFormUrlEncodedParam(paramName, val))
       .reduce((acc, val) => acc + val, '');
   }
diff --git a/spec/validation.spec.js b/spec/validation.spec.js
index 60dcd68e41..265635ea29 100644
--- a/spec/validation.spec.js
+++ b/spec/validation.spec.js
@@ -155,6 +155,14 @@ describe('Request validation', () => {
 
     expect(isValid).toBeTruthy();
   });
+ 
+  it('should validate request body with an array parameter regardless of the position of values in the array', () => {
+    const paramsWithArray = { 'MessagingBinding.Address': ['+1415xxxxxxx', '+1325xxxxxxx'] };
+    const signature = '83O6e2vORAoJHUNzJjDWN1jz+BA=';
+    const isValid = validateRequest(token, signature, requestUrl, paramsWithArray);
+
+    expect(isValid).toBeTruthy();
+  });
 });
 
 describe('Request validation middleware', () => {