#388

Build # #388

Build Type

push

Committed by

Commit Message

<a href="https://github.com/stripe/stripe-node/commit/<a class=hub.com/stripe/stripe-node/commit/5b6153804c8035e38594e8f4adb1d377c96d8300">5b6153804<a href="https://github.com/stripe/stripe-node/commit/5b6153804c8035e38594e8f4adb1d377c96d8300">">Merge </a><a class="double-link" href="https://github.com/stripe/stripe-node/commit/<a class="double-link" href="https://github.com/stripe/stripe-node/commit/66844ff0bebcf2d162e9ad1787eba9213c576480">66844ff0b</a>">66844ff0b</a><a href="https://github.com/stripe/stripe-node/commit/5b6153804c8035e38594e8f4adb1d377c96d8300"> into 3dc8c54cf">3dc8c54cf</a>

Run Details

506 of 574 branches covered (88.15%)

Branch coverage included in aggregate %.

510 of 510 new or added lines in 104 files covered. (100.0%)

1662 of 1728 relevant lines covered (96.18%)

298.54 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

98.44

/cjs/Webhooks.js

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.createWebhooks = void 0;
const Error_js_1 = require("./Error.js");
function createWebhooks(platformFunctions) {
    const Webhook = {
        DEFAULT_TOLERANCE: 300,
        // @ts-ignore
        signature: null,
        constructEvent(payload, header, secret, tolerance, cryptoProvider) {
            this.signature.verifyHeader(payload, header, secret, tolerance || Webhook.DEFAULT_TOLERANCE, cryptoProvider);
            const jsonPayload = payload instanceof Uint8Array
                ? JSON.parse(new TextDecoder('utf8').decode(payload))
                : JSON.parse(payload);
            return jsonPayload;
        },
        async constructEventAsync(payload, header, secret, tolerance, cryptoProvider) {
            await this.signature.verifyHeaderAsync(payload, header, secret, tolerance || Webhook.DEFAULT_TOLERANCE, cryptoProvider);
            const jsonPayload = payload instanceof Uint8Array
                ? JSON.parse(new TextDecoder('utf8').decode(payload))
                : JSON.parse(payload);
            return jsonPayload;
        },
        /**
         * Generates a header to be used for webhook mocking
         *
         * @typedef {object} opts
         * @property {number} timestamp - Timestamp of the header. Defaults to Date.now()
         * @property {string} payload - JSON stringified payload object, containing the 'id' and 'object' parameters
         * @property {string} secret - Stripe webhook secret 'whsec_...'
         * @property {string} scheme - Version of API to hit. Defaults to 'v1'.
         * @property {string} signature - Computed webhook signature
         * @property {CryptoProvider} cryptoProvider - Crypto provider to use for computing the signature if none was provided. Defaults to NodeCryptoProvider.
         */
        generateTestHeaderString: function (opts) {
            if (!opts) {
                throw new Error_js_1.StripeError({
                    message: 'Options are required',
                });
            }
            opts.timestamp =
                Math.floor(opts.timestamp) || Math.floor(Date.now() / 1000);
            opts.scheme = opts.scheme || signature.EXPECTED_SCHEME;
            opts.cryptoProvider = opts.cryptoProvider || getCryptoProvider();
            opts.signature =
                opts.signature ||
                    opts.cryptoProvider.computeHMACSignature(opts.timestamp + '.' + opts.payload, opts.secret);
            const generatedHeader = [
                't=' + opts.timestamp,
                opts.scheme + '=' + opts.signature,
            ].join(',');
            return generatedHeader;
        },
    };
    const signature = {
        EXPECTED_SCHEME: 'v1',
        verifyHeader(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider) {
            const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
            cryptoProvider = cryptoProvider || getCryptoProvider();
            const expectedSignature = cryptoProvider.computeHMACSignature(makeHMACContent(payload, details), secret);
            validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType);
            return true;
        },
        async verifyHeaderAsync(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider) {
            const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
            cryptoProvider = cryptoProvider || getCryptoProvider();
            const expectedSignature = await cryptoProvider.computeHMACSignatureAsync(makeHMACContent(payload, details), secret);
            return validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType);
        },
    };
    function makeHMACContent(payload, details) {
        return `${details.timestamp}.${payload}`;
    }
    function parseEventDetails(encodedPayload, encodedHeader, expectedScheme) {
        if (!encodedPayload) {
            throw new Error_js_1.StripeSignatureVerificationError(encodedHeader, encodedPayload, {
                message: 'No webhook payload was provided.',
            });
        }
        const suspectPayloadType = typeof encodedPayload != 'string' &&
            !(encodedPayload instanceof Uint8Array);
        const textDecoder = new TextDecoder('utf8');
        const decodedPayload = encodedPayload instanceof Uint8Array
            ? textDecoder.decode(encodedPayload)
            : encodedPayload;
        // Express's type for `Request#headers` is `string | []string`
        // which is because the `set-cookie` header is an array,
        // but no other headers are an array (docs: https://nodejs.org/api/http.html#http_message_headers)
        // (Express's Request class is an extension of http.IncomingMessage, and doesn't appear to be relevantly modified: https://github.com/expressjs/express/blob/master/lib/request.js#L31)
        if (Array.isArray(encodedHeader)) {
            throw new Error('Unexpected: An array was passed as a header, which should not be possible for the stripe-signature header.');
        }
        if (encodedHeader == null || encodedHeader == '') {
            throw new Error_js_1.StripeSignatureVerificationError(encodedHeader, encodedPayload, {
                message: 'No stripe-signature header value was provided.',
            });
        }
        const decodedHeader = encodedHeader instanceof Uint8Array
            ? textDecoder.decode(encodedHeader)
            : encodedHeader;
        const details = parseHeader(decodedHeader, expectedScheme);
        if (!details || details.timestamp === -1) {
            throw new Error_js_1.StripeSignatureVerificationError(decodedHeader, decodedPayload, {
                message: 'Unable to extract timestamp and signatures from header',
            });
        }
        if (!details.signatures.length) {
            throw new Error_js_1.StripeSignatureVerificationError(decodedHeader, decodedPayload, {
                message: 'No signatures found with expected scheme',
            });
        }
        return {
            decodedPayload,
            decodedHeader,
            details,
            suspectPayloadType,
        };
    }
    function validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType) {
        const signatureFound = !!details.signatures.filter(platformFunctions.secureCompare.bind(platformFunctions, expectedSignature)).length;
        if (!signatureFound) {
            if (suspectPayloadType) {
                throw new Error_js_1.StripeSignatureVerificationError(header, payload, {
                    message: 'Webhook payload must be provided as a string or a Buffer (https://nodejs.org/api/buffer.html) instance representing the _raw_ request body.' +
                        'Payload was provided as a parsed JavaScript object instead. \n' +
                        'Signature verification is impossible without access to the original signed material. \n' +
                        'Learn more about webhook signing and explore webhook integration examples for various frameworks at ' +
                        'https://github.com/stripe/stripe-node#webhook-signing',
                });
            }
            throw new Error_js_1.StripeSignatureVerificationError(header, payload, {
                message: 'No signatures found matching the expected signature for payload.' +
                    ' Are you passing the raw request body you received from Stripe? \n' +
                    'Learn more about webhook signing and explore webhook integration examples for various frameworks at ' +
                    'https://github.com/stripe/stripe-node#webhook-signing',
            });
        }
        const timestampAge = Math.floor(Date.now() / 1000) - details.timestamp;
        if (tolerance > 0 && timestampAge > tolerance) {
            // @ts-ignore
            throw new Error_js_1.StripeSignatureVerificationError(header, payload, {
                message: 'Timestamp outside the tolerance zone',
            });
        }
        return true;
    }
    function parseHeader(header, scheme) {
        if (typeof header !== 'string') {
            return null;
        }
        return header.split(',').reduce((accum, item) => {
            const kv = item.split('=');
            if (kv[0] === 't') {
                accum.timestamp = parseInt(kv[1], 10);
            }
            if (kv[0] === scheme) {
                accum.signatures.push(kv[1]);
            }
            return accum;
        }, {
            timestamp: -1,
            signatures: [],
        });
    }
    let webhooksCryptoProviderInstance = null;
    /**
     * Lazily instantiate a CryptoProvider instance. This is a stateless object
     * so a singleton can be used here.
     */
    function getCryptoProvider() {
        if (!webhooksCryptoProviderInstance) {
            webhooksCryptoProviderInstance = platformFunctions.createDefaultCryptoProvider();
        }
        return webhooksCryptoProviderInstance;
    }
    Webhook.signature = signature;
    return Webhook;
}
exports.createWebhooks = createWebhooks;

1	"use strict";
2	Object.defineProperty(exports, "__esModule", { value: true });	3✔
3	exports.createWebhooks = void 0;	3✔
4	const Error_js_1 = require("./Error.js");	3✔
5	function createWebhooks(platformFunctions) {
6	const Webhook = {	165✔
7	DEFAULT_TOLERANCE: 300,
8	// @ts-ignore
9	signature: null,
10	constructEvent(payload, header, secret, tolerance, cryptoProvider) {
11	this.signature.verifyHeader(payload, header, secret, tolerance \|\| Webhook.DEFAULT_TOLERANCE, cryptoProvider);	11✔
12	const jsonPayload = payload instanceof Uint8Array	6✔
13	? JSON.parse(new TextDecoder('utf8').decode(payload))
14	: JSON.parse(payload);
15	return jsonPayload;	4✔
16	},
17	async constructEventAsync(payload, header, secret, tolerance, cryptoProvider) {
18	await this.signature.verifyHeaderAsync(payload, header, secret, tolerance \|\| Webhook.DEFAULT_TOLERANCE, cryptoProvider);	11✔
19	const jsonPayload = payload instanceof Uint8Array	6✔
20	? JSON.parse(new TextDecoder('utf8').decode(payload))
21	: JSON.parse(payload);
22	return jsonPayload;	4✔
23	},
24	/**
25	* Generates a header to be used for webhook mocking
26	*
27	* @typedef {object} opts
28	* @property {number} timestamp - Timestamp of the header. Defaults to Date.now()
29	* @property {string} payload - JSON stringified payload object, containing the 'id' and 'object' parameters
30	* @property {string} secret - Stripe webhook secret 'whsec_...'
31	* @property {string} scheme - Version of API to hit. Defaults to 'v1'.
32	* @property {string} signature - Computed webhook signature
33	* @property {CryptoProvider} cryptoProvider - Crypto provider to use for computing the signature if none was provided. Defaults to NodeCryptoProvider.
34	*/
35	generateTestHeaderString: function (opts) {
36	if (!opts) {	34✔
37	throw new Error_js_1.StripeError({	1✔
38	message: 'Options are required',
39	});
40	}
41	opts.timestamp =	33✔
42	Math.floor(opts.timestamp) \|\| Math.floor(Date.now() / 1000);	52✔
43	opts.scheme = opts.scheme \|\| signature.EXPECTED_SCHEME;	33✔
44	opts.cryptoProvider = opts.cryptoProvider \|\| getCryptoProvider();	33✔
45	opts.signature =	33✔
46	opts.signature \|\|	58✔
47	opts.cryptoProvider.computeHMACSignature(opts.timestamp + '.' + opts.payload, opts.secret);
48	const generatedHeader = [	33✔
49	't=' + opts.timestamp,
50	opts.scheme + '=' + opts.signature,
51	].join(',');
52	return generatedHeader;	33✔
53	},
54	};
55	const signature = {	165✔
56	EXPECTED_SCHEME: 'v1',
57	verifyHeader(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider) {
58	const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);	26✔
59	cryptoProvider = cryptoProvider \|\| getCryptoProvider();	16✔
60	const expectedSignature = cryptoProvider.computeHMACSignature(makeHMACContent(payload, details), secret);	16✔
61	validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType);	16✔
62	return true;	11✔
63	},
64	async verifyHeaderAsync(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider) {
65	const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);	26✔
66	cryptoProvider = cryptoProvider \|\| getCryptoProvider();	16✔
67	const expectedSignature = await cryptoProvider.computeHMACSignatureAsync(makeHMACContent(payload, details), secret);	16✔
68	return validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType);	16✔
69	},
70	};
71	function makeHMACContent(payload, details) {
72	return `${details.timestamp}.${payload}`;	32✔
73	}
74	function parseEventDetails(encodedPayload, encodedHeader, expectedScheme) {
75	if (!encodedPayload) {	52✔
76	throw new Error_js_1.StripeSignatureVerificationError(encodedHeader, encodedPayload, {	6✔
77	message: 'No webhook payload was provided.',
78	});
79	}
80	const suspectPayloadType = typeof encodedPayload != 'string' &&	46✔
81	!(encodedPayload instanceof Uint8Array);
82	const textDecoder = new TextDecoder('utf8');	46✔
83	const decodedPayload = encodedPayload instanceof Uint8Array	46✔
84	? textDecoder.decode(encodedPayload)
85	: encodedPayload;
86	// Express's type for `Request#headers` is `string \| []string`
87	// which is because the `set-cookie` header is an array,
88	// but no other headers are an array (docs: https://nodejs.org/api/http.html#http_message_headers)
89	// (Express's Request class is an extension of http.IncomingMessage, and doesn't appear to be relevantly modified: https://github.com/expressjs/express/blob/master/lib/request.js#L31)
90	if (Array.isArray(encodedHeader)) {	46✔
91	throw new Error('Unexpected: An array was passed as a header, which should not be possible for the stripe-signature header.');	2✔
92	}
93	if (encodedHeader == null \|\| encodedHeader == '') {	44✔
94	throw new Error_js_1.StripeSignatureVerificationError(encodedHeader, encodedPayload, {	6✔
95	message: 'No stripe-signature header value was provided.',
96	});
97	}
98	const decodedHeader = encodedHeader instanceof Uint8Array	38✔
99	? textDecoder.decode(encodedHeader)
100	: encodedHeader;
101	const details = parseHeader(decodedHeader, expectedScheme);	38✔
102	if (!details \|\| details.timestamp === -1) {	38✔
103	throw new Error_js_1.StripeSignatureVerificationError(decodedHeader, decodedPayload, {	4✔
104	message: 'Unable to extract timestamp and signatures from header',
105	});
106	}
107	if (!details.signatures.length) {	34✔
108	throw new Error_js_1.StripeSignatureVerificationError(decodedHeader, decodedPayload, {	2✔
109	message: 'No signatures found with expected scheme',
110	});
111	}
112	return {	32✔
113	decodedPayload,
114	decodedHeader,
115	details,
116	suspectPayloadType,
117	};
118	}
119	function validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType) {
120	const signatureFound = !!details.signatures.filter(platformFunctions.secureCompare.bind(platformFunctions, expectedSignature)).length;	32✔
121	if (!signatureFound) {	32✔
122	if (suspectPayloadType) {	8✔
123	throw new Error_js_1.StripeSignatureVerificationError(header, payload, {	4✔
124	message: 'Webhook payload must be provided as a string or a Buffer (https://nodejs.org/api/buffer.html) instance representing the _raw_ request body.' +
125	'Payload was provided as a parsed JavaScript object instead. \n' +
126	'Signature verification is impossible without access to the original signed material. \n' +
127	'Learn more about webhook signing and explore webhook integration examples for various frameworks at ' +
128	'https://github.com/stripe/stripe-node#webhook-signing',
129	});
130	}
131	throw new Error_js_1.StripeSignatureVerificationError(header, payload, {	4✔
132	message: 'No signatures found matching the expected signature for payload.' +
133	' Are you passing the raw request body you received from Stripe? \n' +
134	'Learn more about webhook signing and explore webhook integration examples for various frameworks at ' +
135	'https://github.com/stripe/stripe-node#webhook-signing',
136	});
137	}
138	const timestampAge = Math.floor(Date.now() / 1000) - details.timestamp;	24✔
139	if (tolerance > 0 && timestampAge > tolerance) {	24✔
140	// @ts-ignore
141	throw new Error_js_1.StripeSignatureVerificationError(header, payload, {	2✔
142	message: 'Timestamp outside the tolerance zone',
143	});
144	}
145	return true;	22✔
146	}
147	function parseHeader(header, scheme) {
148	if (typeof header !== 'string') {	38!
149	return null;	×
150	}
151	return header.split(',').reduce((accum, item) => {	38✔
152	const kv = item.split('=');	74✔
153	if (kv[0] === 't') {	74✔
154	accum.timestamp = parseInt(kv[1], 10);	34✔
155	}
156	if (kv[0] === scheme) {	74✔
157	accum.signatures.push(kv[1]);	34✔
158	}
159	return accum;	74✔
160	}, {
161	timestamp: -1,
162	signatures: [],
163	});
164	}
165	let webhooksCryptoProviderInstance = null;	165✔
166	/**
167	* Lazily instantiate a CryptoProvider instance. This is a stateless object
168	* so a singleton can be used here.
169	*/
170	function getCryptoProvider() {
171	if (!webhooksCryptoProviderInstance) {	59✔
172	webhooksCryptoProviderInstance = platformFunctions.createDefaultCryptoProvider();	1✔
173	}
174	return webhooksCryptoProviderInstance;	59✔
175	}
176	Webhook.signature = signature;	165✔
177	return Webhook;	165✔
178	}
179	exports.createWebhooks = createWebhooks;	3✔

stripe / stripe-node / #388

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous