Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RequestValidator marks valid signature invalid when having multiple values attached to one parameter #616

Open
hugo-netcraft opened this issue Aug 12, 2022 · 1 comment
Labels
status: help wanted requesting help from the community type: bug bug in the library

Comments

@hugo-netcraft
Copy link

Issue Summary

Same issue as twilio/twilio-python#613

But to summarize, when Autopilot assigns a Field multiple values, the signature will be marked as invalid, due to the incorrect formatting of the string which is encrypted.

The proper format for the string should be the same as whats described in twilio/twilio-python#613 (comment)

However there one slight issue with the recommended setup for ruby which will currently make it impossible to validate the signature. As seen in the Exception log, the Field_number_Value only has one value set, which means that sinatra is incorrectly setting parameter.

I am filing the issue here because even if sinatra did give some form of array output, there is nothing in the code I can find to suggest anything that accounts for this possibility. Plus Twilio shouldn't be recommending this software if it doesn't fully support all of its features. I copied the code for formatting the parameters and tried it on an example:

params = Hash["something" => 1, "array" => Array[24,48,9]]

data = params.sort.join

print(data)

And got the output array24489something1 which is the incorrect format

Steps to Reproduce

  1. Setup the bot described in RequestValidator marks valid signature invalid when having multiple values attached to one parameter twilio-python#613
  2. Setup sever below
  3. Check a valid signature is given when giving "6 hi hi" as the input
  4. Run the server, using "6 hi 4 hi 3" as the input

Code Snippet

Server setup:

require 'sinatra'
require 'twilio-ruby'

post '/autopilot' do
    content_type :json

    @params = params
    p @params
    auth_token = '*********************************'
    sig = request.env["HTTP_X_TWILIO_SIGNATURE"]
    validator = Twilio::Security::RequestValidator.new(auth_token)
    url = 'https://******************************.eu.ngrok.io/autopilot'
    if validator.validate(url, params, sig)
        print "Valid signature\n"
    else
        print "Invalid signature\n"

    { :actions => [ { :say => "Hello" } ]}.to_json
end

Exception/Log

{"CurrentTask"=>"numbers", "Field_number_Value"=>"3", "Memory"=>"{\"twilio\":{\"chat\":{\"ChannelSid\":\"CHXXXXXXXXXXXXXXXXXXXXXXXX\",\"AssistantName\":\"\",\"Attributes\":{},\"ServiceSid\":\"IS100258ed6533477db9e6cd6d601bfdf7\",\"Index\":89,\"From\":\"\",\"MessageSid\":\"IMXXXXXXXXXXXXXXXXXXXXXXXX\"}}}", "Channel"=>"chat", "NextBestTask"=>"", "CurrentTaskConfidence"=>"1.0", "AccountSid"=>"ACXXXXXXXXXXXXXXXXXXXXXXXX", "CurrentInput"=>"6 hi 4 hi 3", "DialogueSid"=>"UKXXXXXXXXXXXXXXXXXXXXXXXX", "DialoguePayloadUrl"=>"https://autopilot.twilio.com/v1/Assistants/UAXXXXXXXXXXXXXXXXXXXXXXXX/Dialogues/UKXXXXXXXXXXXXXXXXXXXXXXXX", "AssistantSid"=>"UAXXXXXXXXXXXXXXXXXXXXXXXX", "Field_number_Type"=>"Twilio.NUMBER", "UserIdentifier"=>""}
Invalid signature

Technical details:

  • twilio-ruby version:
  • ruby version:
@claudiachua
Copy link
Contributor

claudiachua commented Aug 17, 2022

This issue has been added to our internal backlog to be prioritized. Pull requests and +1s on the issue summary will help it move up the backlog (ref: DI-2305)

@claudiachua claudiachua added type: bug bug in the library status: help wanted requesting help from the community labels Aug 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: help wanted requesting help from the community type: bug bug in the library
Projects
None yet
Development

No branches or pull requests

2 participants