fix: webhook validation with an array parameter

lib/webhooks/webhooks.js

@@ -50,6 +50,22 @@ function removePort(parsedUrl) {
   return parsedUrl.toString();
 }
 
+/**
+ Utility function to convert request parameter to a string format
+
+ @param {string} paramName - The request parameter name
+ @param {string|array<string>} paramValue - The request parameter value
+ @returns {string} - Formatted parameter string
+ */
+function toFormUrlEncodedParam(paramName, paramValue) {
+  if (paramValue instanceof Array) {
+    return paramValue
+      .map(val => toFormUrlEncodedParam(paramName, val))
+      .reduce((acc, val) => acc + val, '');
+  }
+  return paramName + paramValue;
+}
+
 /**
  Utility function to get the expected signature for a given request
 
@@ -65,7 +81,7 @@ function getExpectedTwilioSignature(authToken, url, params) {
 
   var data = Object.keys(params)
     .sort()
-    .reduce((acc, key) => acc + key + params[key], url);
+    .reduce((acc, key) => acc + toFormUrlEncodedParam(key, params[key]), url);
 
   return crypto
     .createHmac('sha1', authToken)

spec/validation.spec.js

@@ -147,6 +147,14 @@ describe('Request validation', () => {
 
     expect(isValid).toBeTruthy();
   });
+
+  it('should validate request body with an array parameter', () => {
+    const paramsWithArray = { 'MessagingBinding.Address': ['+1325xxxxxxx', '+1415xxxxxxx'] };
+    const signature = '83O6e2vORAoJHUNzJjDWN1jz+BA=';
+    const isValid = validateRequest(token, signature, requestUrl, paramsWithArray);
+
+    expect(isValid).toBeTruthy();
+  });
 });
 
 describe('Request validation middleware', () => {