fix: consider query strings in Twilio request validation #33364
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Looks like this PR is ready to merge! 🎉 |
🦋 Changeset detectedLatest commit: 5db0871 The changes in this PR will be included in the next version bump. This PR includes changesets to release 33 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop #33364 +/- ##
========================================
Coverage 58.41% 58.41%
========================================
Files 2744 2744
Lines 66255 66257 +2
Branches 14990 14991 +1
========================================
+ Hits 38703 38706 +3
Misses 24732 24732
+ Partials 2820 2819 -1
Flags with carried forward coverage won't be shown. Click here to find out more. |
abhinavkrin
approved these changes
Sep 27, 2024
tapiarafael
approved these changes
Sep 27, 2024
KevLehman
approved these changes
Sep 30, 2024
jessicaschelly
added
the
stat: QA assured
dionisio-bot
bot
added
the
stat: ready to merge
dionisio-bot
bot
removed
the
stat: ready to merge
julio-cfa
added
stat: ready to merge
gabriellsh
added a commit
that referenced
this pull request
Oct 15, 2024
…ctor/avatar * 'develop' of github.com:RocketChat/Rocket.Chat: (58 commits) refactor: unified users page header content into a single component (#33498) chore: store contact emails and phones on the same format as user's and visitor's (#33484) fix: broken jump-to-thread-message functionality using link (#33332) feat: Apps-Engine method for reading and counting unread room messages for a user (#32194) feat: adds a new featured room action on the header for non-default category (#33562) chore(deps): bump actions/setup-node from 4.0.3 to 4.0.4 (#33327) fix: consider query strings in Twilio request validation (#33364) ci: add restore cache for `deploy-preview` (#33579) feat: add history endpoint (#33349) ci: cache artifacts to reduce api calls (#33567) feat: new E2EE composer hint (#33283) chore: Add `force` option to `rmSync` call (#33570) chore: remove nameInsensitive sorting on /v1/users.listByStatus (#33401) chore: Use `rmSync` instead of `rmdirSync` (#33551) feat: add contact channels (#33308) chore: split ImportDataConverter into multiple classes and add unit testing (#33394) test: added MockedDeviceContext to voip unit tests (#33553) refactor: adjusted voip endpoints error messages (#33515) fix: Cannot send messages after E2EE keys are refreshed (#33527) fix: Custom sounds not working when storage is set to filesystem (#33424) ...
Closed
ggazzo
pushed a commit
that referenced
this pull request
Nov 6, 2024
ggazzo
pushed a commit
that referenced
this pull request
Nov 6, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes (including videos or screenshots)
A security fix a couple of versions ago may have introduced a bug for Twilio requests containing a query string. This PR changes the Twilio request validation to take into consideration requests with query strings, adds a unit test for this specific case, and removes a duplicated test from the previous changes.
The GitHub issue regarding this problem can be seen below.
Issue(s)
#33318
SUP-668
Steps to test or reproduce
N/A
Further comments
N/A