fix: switch to a URL parsing lib that does not add percent-encoding

lib/webhooks/webhooks.js

@@ -4,11 +4,12 @@ var crypto = require('crypto');
 var _ = require('lodash');
 var scmp = require('scmp');
 var urllib = require('url');
+var Url = require('url-parse');
 
 /**
  * Utility function to construct the URL string, since Node.js url library won't include standard port numbers
  *
- * @param {URL} parsedUrl - The parsed url object that Twilio requested on your server
+ * @param {Url} parsedUrl - The parsed url object that Twilio requested on your server
  * @returns {string} - URL with standard port number included
  */
 function buildUrlWithStandardPort(parsedUrl) {
@@ -20,15 +21,15 @@ function buildUrlWithStandardPort(parsedUrl) {
   url += parsedUrl.password ? ':' + parsedUrl.password : '';
   url += (parsedUrl.username || parsedUrl.password) ? '@' : '';
   url += parsedUrl.host ? parsedUrl.host + port : '';
-  url += parsedUrl.pathname + parsedUrl.search + parsedUrl.hash;
+  url += parsedUrl.pathname + parsedUrl.query + parsedUrl.hash;
 
   return url;
 }
 
 /**
  Utility function to add a port number to a URL
 
- @param {URL} parsedUrl - The parsed url object that Twilio requested on your server
+ @param {Url} parsedUrl - The parsed url object that Twilio requested on your server
  @returns {string} - URL with port
  */
 function addPort(parsedUrl) {
@@ -41,11 +42,11 @@ function addPort(parsedUrl) {
 /**
  Utility function to remove a port number from a URL
 
- @param {URL} parsedUrl - The parsed url object that Twilio requested on your server
+ @param {Url} parsedUrl - The parsed url object that Twilio requested on your server
  @returns {string} - URL without port
  */
 function removePort(parsedUrl) {
-  parsedUrl.port = '';
+  parsedUrl.set('port', '');
   return parsedUrl.toString();
 }
 
@@ -95,7 +96,7 @@ function getExpectedBodyHash(body) {
  */
 function validateRequest(authToken, twilioHeader, url, params) {
   twilioHeader = twilioHeader || '';
-  const urlObject = new urllib.URL(url);
+  const urlObject = new Url(url);
   const urlWithPort = addPort(urlObject);
   const urlWithoutPort = removePort(urlObject);
 
@@ -127,9 +128,9 @@ function validateBody(body, bodyHash) {
  @returns {boolean} - valid
  */
 function validateRequestWithBody(authToken, twilioHeader, url, body) {
-  const urlObject = new urllib.URL(url);
+  const urlObject = new Url(url, true);
   return validateRequest(authToken, twilioHeader, url, {}) &&
-    validateBody(body, urlObject.searchParams.get('bodySHA256'));
+    validateBody(body, urlObject.query.bodySHA256);
 }
 
 /**

package.json

@@ -28,6 +28,7 @@
     "request": "^2.88.0",
     "rootpath": "^0.1.2",
     "scmp": "^2.0.0",
+    "url-parse": "^1.4.7",
     "xmlbuilder": "^13.0.2"
   },
   "devDependencies": {

spec/validation.spec.js

@@ -129,6 +129,14 @@ describe('Request validation', () => {
 
     expect(isValid).toBeTruthy();
   });
+
+  it('should validate urls with special characters', () => {
+    const specialRequestUrl = requestUrl + '&Body=It\'s+amazing';
+    const signature = 'dsq4Ehbj6cs+KdTkpF5sSSplOWw=';
+    const isValid = validateRequest(token, signature, specialRequestUrl, defaultParams);
+
+    expect(isValid).toBeTruthy();
+  });
 });
 
 describe('Request validation middleware', () => {