Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
var handleMessage = function(req, reply) {
var header = req.headers['x-twilio-signature'];
var token = process.env.TWILIO_AUTH_TOKEN;
var url_base = 'http://'+req.info.host;
if (!twilio.validateRequest(token, header, url_base+'/message', req.payload)) {
reply(Boom.forbidden('Invalid x-twilio-signature'));
return;
}
var from = req.payload.From;
var to = req.payload.To;
var mediaUrl = req.payload.MediaUrl0;
var mediaContentType = req.payload.MediaContentType0;
var filter = req.payload.Body.toLowerCase().trim();
var twiml = new twilio.TwimlResponse();
console.log('Processing MMS: ', mediaUrl, mediaContentType, filter);
// see if a valid filter was passed
var filterValid = false;
for (i in filters) {
// The Twilio request URL
const url = 'https://mycompany.com/myapp.php?foo=1&bar=2';
// The post variables in Twilio's request
const params = {
CallSid: 'CA1234567890ABCDE',
Caller: '+12349013030',
Digits: '1234',
From: '+12349013030',
To: '+18005551212',
};
// The X-Twilio-Signature header attached to the request
const twilioSignature = 'GvWf1cFY/Q7PnoempGyD5oXAezc=';
console.log(client.validateRequest(authToken, twilioSignature, url, params));
// The Twilio request URL
const url = 'https://mycompany.com/myapp.php?foo=1&bar=2';
// The post variables in Twilio's request
const params = {
CallSid: 'CA1234567890ABCDE',
Caller: '+14158675309',
Digits: '1234',
From: '+14158675309',
To: '+18005551212',
};
// The X-Twilio-Signature header attached to the request
const twilioSignature = 'RSOYDt4T1cUTdK1PDd93/VVr8B8=';
console.log(client.validateRequest(authToken, twilioSignature, url, params));
// Restify style
if (!req.headers) {
twilioSignature = req.header('x-twilio-signature');
validation_url = this.options.validation_url ||
(req.headers['x-forwarded-proto'] || (req.isSecure()) ? 'https' : 'http') + '://' + req.headers.host + req.url;
} else {
// express style
twilioSignature = req.headers['x-twilio-signature'];
validation_url = this.options.validation_url ||
((req.headers['x-forwarded-proto'] || req.protocol) + '://' + req.hostname + req.originalUrl);
}
if (twilioSignature && Twilio.validateRequest(this.options.auth_token, twilioSignature, validation_url, req.body)) {
return true;
} else {
debug('Signature verification failed, Ignoring message');
res.status(400);
res.send({
error: 'Invalid signature.'
});
return false;
}
}
}
function validateTwilioSignature(ev, params) {
const headers = ev.headers;
const host = headers.Host;
const reqPath = ev.requestContext.path;
const twilioSignature = headers['X-Twilio-Signature'];
const url = `https://${host}${reqPath}`;
const result = twilio.validateRequest(TWILIO_TOKEN, twilioSignature, url,
params);
if (!result) {
console.log("Twilio signature validation failed!", url, params,
twilioSignature);
}
return result;
}
app.post(config.twilio.webhook_path, function(request, response) {
const twilioSignature = request.header('X-Twilio-Signature');
const validTwilioRequest = twilio.validateRequest(
config.twilio.authToken,
twilioSignature,
config.twilio.webhookUrl,
request.body
);
if (validTwilioRequest) {
response.set('Content-Type', 'text/xml');
if (!config.twilio.allowedNumbers.includes(request.body.From)) {
console.log(
`Received command from disallowed number ${
request.From
}. Not responding.`
);
handlePost: function( server, request, channel, reply ) {
const redis = server.app.redis;
let payload = request.payload;
//Using ngrok requests look like http even though the Twilio url is https
//This causes validation to fail. For now forcing https.
//console.log(request.connection.info)
//Validate Request
const url = (request.headers.schema || "https") + "://"
+ (request.headers.host || request.info.host)
+ (request.headers.basePath || "")
+ (request.headers.path || request.url.path);
const twilioSignature = request.headers["x-twilio-signature"];
const validation = Twilio.validateRequest(channel.authToken, twilioSignature, url, payload);
if (validation) {
if (payload.From && payload.Body) {
if ((channel.whiteList && channel.whiteList.indexOf(payload.From) != -1) || !channel.whiteList || channel.whiteList == []) {
let sessionId = hash(payload)
let options = {
method: 'POST',
url: `/agent/${channel.agent}/converse`,
payload: {
text: payload.Body,
sessionId: sessionId,
ubiquity: {
twilio: payload
}
}
}
function verifyRequest(req, res, next) {
var twilioSignature = req.headers['x-twilio-signature'];
var validation_url = twilioSMS.config.validation_url ||
((req.headers['x-forwarded-proto'] || req.protocol) + '://' + req.hostname + req.originalUrl);
if (Twilio.validateRequest(twilioSMS.config.auth_token, twilioSignature, validation_url, req.body)) {
next();
} else {
twilioSMS.log('** Invalid twilio signature on incoming request!');
res.status(400).send({
error: 'Invalid signature.'
});
}
}