feat: Improve webhook validation checks (box/box-codegen#745) (#647)

Author: box-sdk-build

.codegen.json

@@ -1 +1 @@
-{ "engineHash": "fe0e7f5", "specHash": "83a5340", "version": "1.16.0" }
+{ "engineHash": "c7328b5", "specHash": "83a5340", "version": "1.16.0" }

package-lock.json

@@ -680,7 +680,8 @@ export class WebhooksManager {
       return false;
     }
     if (
-      primaryKey &&
+      !(primaryKey == void 0) &&
+      !(headers['box-signature-primary'] == void 0) &&
       (await compareSignatures(
         await computeWebhookSignature(body, headers, primaryKey, false),
         headers['box-signature-primary'],
@@ -689,7 +690,8 @@ export class WebhooksManager {
       return true;
     }
     if (
-      primaryKey &&
+      !(primaryKey == void 0) &&
+      !(headers['box-signature-primary'] == void 0) &&
       (await compareSignatures(
         await computeWebhookSignature(body, headers, primaryKey, true),
         headers['box-signature-primary'],
@@ -698,7 +700,8 @@ export class WebhooksManager {
       return true;
     }
     if (
-      secondaryKey &&
+      !(secondaryKey == void 0) &&
+      !(headers['box-signature-secondary'] == void 0) &&
       (await compareSignatures(
         await computeWebhookSignature(body, headers, secondaryKey, false),
         headers['box-signature-secondary'],
@@ -707,7 +710,8 @@ export class WebhooksManager {
       return true;
     }
     if (
-      secondaryKey &&
+      !(secondaryKey == void 0) &&
+      !(headers['box-signature-secondary'] == void 0) &&
       (await compareSignatures(
         await computeWebhookSignature(body, headers, secondaryKey, true),
         headers['box-signature-secondary'],

src/managers/webhooks.generated.ts

@@ -139,39 +139,39 @@ test('testWebhookValidation', async function testWebhookValidation(): Promise<an
     ['box-signature-version']: '1',
   };
   const headersWithJapanese: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
       ['box-signature-primary']: 'LV2uCu+5NJtIHrCXDYgZ0v/PP5THGRuegw3RtdnEyuE=',
     },
   };
   const headersWithEmoji: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
       ['box-signature-primary']: 'xF/SDZosX4le+v4A0Qn59sZhuD1RqY5KRUKzVMSbh0E=',
     },
   };
   const headersWithCarriageReturn: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
       ['box-signature-primary']: 'SVkbKgy3dEEf2PbbzpNu2lDZS7zZ/aboU7HOZgBGrJk=',
     },
   };
   const headersWithForwardSlash: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
       ['box-signature-primary']: 't41PWT5ZB6OcysnD6SDy9Ud+p9hdXxIdXqcdweyZv/Q=',
     },
   };
   const headersWithBackSlash: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
@@ -188,96 +188,96 @@ test('testWebhookValidation', async function testWebhookValidation(): Promise<an
     epochSecondsToDateTime(getEpochTimeInSeconds() - 1200),
   );
   const headersWithCorrectDatetime: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
       ['box-delivery-timestamp']: currentDatetime,
-      ['box-signature-primary']: await computeWebhookSignature(
+      ['box-signature-primary']: (await computeWebhookSignature(
         body,
         { ...headers, ...{ ['box-delivery-timestamp']: currentDatetime } },
         primaryKey,
         true,
-      ),
-      ['box-signature-secondary']: await computeWebhookSignature(
+      ))!,
+      ['box-signature-secondary']: (await computeWebhookSignature(
         body,
         { ...headers, ...{ ['box-delivery-timestamp']: currentDatetime } },
         secondaryKey,
         true,
-      ),
+      ))!,
     },
   };
   const headersWithJapaneseWithCorrectDatetime: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headersWithJapanese,
     ...{
       ['box-delivery-timestamp']: currentDatetime,
-      ['box-signature-primary']: await computeWebhookSignature(
+      ['box-signature-primary']: (await computeWebhookSignature(
         bodyWithJapanese,
         {
           ...headersWithJapanese,
           ...{ ['box-delivery-timestamp']: currentDatetime },
         },
         primaryKey,
         true,
-      ),
-      ['box-signature-secondary']: await computeWebhookSignature(
+      ))!,
+      ['box-signature-secondary']: (await computeWebhookSignature(
         bodyWithJapanese,
         {
           ...headersWithJapanese,
           ...{ ['box-delivery-timestamp']: currentDatetime },
         },
         secondaryKey,
         true,
-      ),
+      ))!,
     },
   };
   const headersWithFutureDatetime: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
       ['box-delivery-timestamp']: futureDatetime,
-      ['box-signature-primary']: await computeWebhookSignature(
+      ['box-signature-primary']: (await computeWebhookSignature(
         body,
         { ...headers, ...{ ['box-delivery-timestamp']: futureDatetime } },
         primaryKey,
         true,
-      ),
-      ['box-signature-secondary']: await computeWebhookSignature(
+      ))!,
+      ['box-signature-secondary']: (await computeWebhookSignature(
         body,
         { ...headers, ...{ ['box-delivery-timestamp']: futureDatetime } },
         secondaryKey,
         true,
-      ),
+      ))!,
     },
   };
   const headersWithPastDatetime: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = {
     ...headers,
     ...{
       ['box-delivery-timestamp']: pastDatetime,
-      ['box-signature-primary']: await computeWebhookSignature(
+      ['box-signature-primary']: (await computeWebhookSignature(
         body,
         { ...headers, ...{ ['box-delivery-timestamp']: pastDatetime } },
         primaryKey,
         true,
-      ),
-      ['box-signature-secondary']: await computeWebhookSignature(
+      ))!,
+      ['box-signature-secondary']: (await computeWebhookSignature(
         body,
         { ...headers, ...{ ['box-delivery-timestamp']: pastDatetime } },
         secondaryKey,
         true,
-      ),
+      ))!,
     },
   };
   const headersWithWrongSignatureVersion: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = { ...headers, ...{ ['box-signature-version']: '2' } };
   const headersWithWrongSignatureAlgorithm: {
-    readonly [key: string]: any;
+    readonly [key: string]: string;
   } = { ...headers, ...{ ['box-signature-algorithm']: 'HmacSHA1' } };
   if (
     !(await compareSignatures(