Skip to content

Commit 48cbfdf

Browse files
vincentkocvincentkoc
authored
Hardening: require LINE webhook signatures (openclaw#44090)
* LINE: require webhook signatures in express handler * LINE: require webhook signatures in node handler * LINE: update express signature tests * LINE: update node signature tests * Changelog: note LINE webhook hardening * LINE: validate signatures before parsing webhook bodies * LINE: reject missing signatures before body reads
1 parent c965049 commit 48cbfdf

File tree

6 files changed

+60
-49
lines changed

6 files changed

+60
-49
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ Docs: https://docs.openclaw.ai
1515
- Security/browser.request: block persistent browser profile create/delete routes from write-scoped `browser.request` so callers can no longer persist admin-only browser profile changes through the browser control surface. (`GHSA-vmhq-cqm9-6p7q`)(#43800) Thanks @tdjackey and @vincentkoc.
1616
- Security/agent: reject public spawned-run lineage fields and keep workspace inheritance on the internal spawned-session path so external `agent` callers can no longer override the gateway workspace boundary. (`GHSA-2rqg-gjgv-84jm`)(#43801) Thanks @tdjackey and @vincentkoc.
1717
- Security/exec allowlist: preserve POSIX case sensitivity and keep `?` within a single path segment so exact-looking allowlist patterns no longer overmatch executables across case or directory boundaries. (`GHSA-f8r2-vg7x-gh8m`)(#43798) Thanks @zpbrent and @vincentkoc.
18+
- Security/LINE webhook: require signatures for empty-event POST probes too so unsigned requests no longer confirm webhook reachability with a `200` response. (`GHSA-mhxh-9pjm-w7q5`)(#44090) Thanks @TerminalsandCoffee and @vincentkoc.
1819

1920
### Changes
2021

‎src/line/webhook-node.test.ts‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -86,13 +86,26 @@ describe("createLineNodeWebhookHandler", () => {
8686
expect(res.body).toBeUndefined();
8787
});
8888

89-
it("returns 200 for verification request (empty events, no signature)", async () => {
89+
it("rejects verification-shaped requests without a signature", async () => {
9090
const rawBody = JSON.stringify({ events: [] });
9191
const { bot, handler } = createPostWebhookTestHarness(rawBody);
9292

9393
const { res, headers } = createRes();
9494
await handler({ method: "POST", headers: {} } as unknown as IncomingMessage, res);
9595

96+
expect(res.statusCode).toBe(400);
97+
expect(headers["content-type"]).toBe("application/json");
98+
expect(res.body).toBe(JSON.stringify({ error: "Missing X-Line-Signature header" }));
99+
expect(bot.handleWebhook).not.toHaveBeenCalled();
100+
});
101+
102+
it("accepts signed verification-shaped requests without dispatching events", async () => {
103+
const rawBody = JSON.stringify({ events: [] });
104+
const { bot, handler, secret } = createPostWebhookTestHarness(rawBody);
105+
106+
const { res, headers } = createRes();
107+
await runSignedPost({ handler, rawBody, secret, res });
108+
96109
expect(res.statusCode).toBe(200);
97110
expect(headers["content-type"]).toBe("application/json");
98111
expect(res.body).toBe(JSON.stringify({ status: "ok" }));
@@ -121,13 +134,10 @@ describe("createLineNodeWebhookHandler", () => {
121134
expect(bot.handleWebhook).not.toHaveBeenCalled();
122135
});
123136

124-
it("uses a tight body-read limit for unsigned POST requests", async () => {
137+
it("rejects unsigned POST requests before reading the body", async () => {
125138
const bot = { handleWebhook: vi.fn(async () => {}) };
126139
const runtime = { log: vi.fn(), error: vi.fn(), exit: vi.fn() };
127-
const readBody = vi.fn(async (_req: IncomingMessage, maxBytes: number) => {
128-
expect(maxBytes).toBe(4096);
129-
return JSON.stringify({ events: [{ type: "message" }] });
130-
});
140+
const readBody = vi.fn(async () => JSON.stringify({ events: [{ type: "message" }] }));
131141
const handler = createLineNodeWebhookHandler({
132142
channelSecret: "secret",
133143
bot,
@@ -139,7 +149,7 @@ describe("createLineNodeWebhookHandler", () => {
139149
await handler({ method: "POST", headers: {} } as unknown as IncomingMessage, res);
140150

141151
expect(res.statusCode).toBe(400);
142-
expect(readBody).toHaveBeenCalledTimes(1);
152+
expect(readBody).not.toHaveBeenCalled();
143153
expect(bot.handleWebhook).not.toHaveBeenCalled();
144154
});
145155

‎src/line/webhook-node.ts‎

Lines changed: 13 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,10 @@ import {
88
} from "../infra/http-body.js";
99
import type { RuntimeEnv } from "../runtime.js";
1010
import { validateLineSignature } from "./signature.js";
11-
import { isLineWebhookVerificationRequest, parseLineWebhookBody } from "./webhook-utils.js";
11+
import { parseLineWebhookBody } from "./webhook-utils.js";
1212

1313
const LINE_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
1414
const LINE_WEBHOOK_PREAUTH_MAX_BODY_BYTES = 64 * 1024;
15-
const LINE_WEBHOOK_UNSIGNED_MAX_BODY_BYTES = 4 * 1024;
1615
const LINE_WEBHOOK_PREAUTH_BODY_TIMEOUT_MS = 5_000;
1716

1817
export async function readLineWebhookRequestBody(
@@ -65,37 +64,25 @@ export function createLineNodeWebhookHandler(params: {
6564
const signatureHeader = req.headers["x-line-signature"];
6665
const signature =
6766
typeof signatureHeader === "string"
68-
? signatureHeader
67+
? signatureHeader.trim()
6968
: Array.isArray(signatureHeader)
70-
? signatureHeader[0]
71-
: undefined;
72-
const hasSignature = typeof signature === "string" && signature.trim().length > 0;
73-
const bodyLimit = hasSignature
74-
? Math.min(maxBodyBytes, LINE_WEBHOOK_PREAUTH_MAX_BODY_BYTES)
75-
: Math.min(maxBodyBytes, LINE_WEBHOOK_UNSIGNED_MAX_BODY_BYTES);
76-
const rawBody = await readBody(req, bodyLimit, LINE_WEBHOOK_PREAUTH_BODY_TIMEOUT_MS);
69+
? (signatureHeader[0] ?? "").trim()
70+
: "";
7771

78-
// Parse once; we may need it for verification requests and for event processing.
79-
const body = parseLineWebhookBody(rawBody);
80-
81-
// LINE webhook verification sends POST {"events":[]} without a
82-
// signature header. Return 200 so the LINE Developers Console
83-
// "Verify" button succeeds.
84-
if (!hasSignature) {
85-
if (isLineWebhookVerificationRequest(body)) {
86-
logVerbose("line: webhook verification request (empty events, no signature) - 200 OK");
87-
res.statusCode = 200;
88-
res.setHeader("Content-Type", "application/json");
89-
res.end(JSON.stringify({ status: "ok" }));
90-
return;
91-
}
72+
if (!signature) {
9273
logVerbose("line: webhook missing X-Line-Signature header");
9374
res.statusCode = 400;
9475
res.setHeader("Content-Type", "application/json");
9576
res.end(JSON.stringify({ error: "Missing X-Line-Signature header" }));
9677
return;
9778
}
9879

80+
const rawBody = await readBody(
81+
req,
82+
Math.min(maxBodyBytes, LINE_WEBHOOK_PREAUTH_MAX_BODY_BYTES),
83+
LINE_WEBHOOK_PREAUTH_BODY_TIMEOUT_MS,
84+
);
85+
9986
if (!validateLineSignature(rawBody, signature, params.channelSecret)) {
10087
logVerbose("line: webhook signature validation failed");
10188
res.statusCode = 401;
@@ -104,6 +91,8 @@ export function createLineNodeWebhookHandler(params: {
10491
return;
10592
}
10693

94+
const body = parseLineWebhookBody(rawBody);
95+
10796
if (!body) {
10897
res.statusCode = 400;
10998
res.setHeader("Content-Type", "application/json");

‎src/line/webhook-utils.ts‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,3 @@ export function parseLineWebhookBody(rawBody: string): WebhookRequestBody | null
77
return null;
88
}
99
}
10-
11-
export function isLineWebhookVerificationRequest(
12-
body: WebhookRequestBody | null | undefined,
13-
): boolean {
14-
return !!body && Array.isArray(body.events) && body.events.length === 0;
15-
}

‎src/line/webhook.test.ts‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,17 +87,34 @@ describe("createLineWebhookMiddleware", () => {
8787
expect(onEvents).not.toHaveBeenCalled();
8888
});
8989

90-
it("returns 200 for verification request (empty events, no signature)", async () => {
90+
it("rejects verification-shaped requests without a signature", async () => {
9191
const { res, onEvents } = await invokeWebhook({
9292
body: JSON.stringify({ events: [] }),
9393
headers: {},
9494
autoSign: false,
9595
});
96+
expect(res.status).toHaveBeenCalledWith(400);
97+
expect(res.json).toHaveBeenCalledWith({ error: "Missing X-Line-Signature header" });
98+
expect(onEvents).not.toHaveBeenCalled();
99+
});
100+
101+
it("accepts signed verification-shaped requests without dispatching events", async () => {
102+
const { res, onEvents } = await invokeWebhook({
103+
body: JSON.stringify({ events: [] }),
104+
});
96105
expect(res.status).toHaveBeenCalledWith(200);
97106
expect(res.json).toHaveBeenCalledWith({ status: "ok" });
98107
expect(onEvents).not.toHaveBeenCalled();
99108
});
100109

110+
it("rejects oversized signed payloads before JSON parsing", async () => {
111+
const largeBody = JSON.stringify({ events: [], payload: "x".repeat(70 * 1024) });
112+
const { res, onEvents } = await invokeWebhook({ body: largeBody });
113+
expect(res.status).toHaveBeenCalledWith(413);
114+
expect(res.json).toHaveBeenCalledWith({ error: "Payload too large" });
115+
expect(onEvents).not.toHaveBeenCalled();
116+
});
117+
101118
it("rejects missing signature when events are non-empty", async () => {
102119
const { res, onEvents } = await invokeWebhook({
103120
body: JSON.stringify({ events: [{ type: "message" }] }),

‎src/line/webhook.ts‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@ import type { Request, Response, NextFunction } from "express";
33
import { logVerbose, danger } from "../globals.js";
44
import type { RuntimeEnv } from "../runtime.js";
55
import { validateLineSignature } from "./signature.js";
6-
import { isLineWebhookVerificationRequest, parseLineWebhookBody } from "./webhook-utils.js";
6+
import { parseLineWebhookBody } from "./webhook-utils.js";
7+
8+
const LINE_WEBHOOK_MAX_RAW_BODY_BYTES = 64 * 1024;
79

810
export interface LineWebhookOptions {
911
channelSecret: string;
@@ -39,33 +41,31 @@ export function createLineWebhookMiddleware(
3941
return async (req: Request, res: Response, _next: NextFunction): Promise<void> => {
4042
try {
4143
const signature = req.headers["x-line-signature"];
42-
const rawBody = readRawBody(req);
43-
const body = parseWebhookBody(req, rawBody);
4444

45-
// LINE webhook verification sends POST {"events":[]} without a
46-
// signature header. Return 200 immediately so the LINE Developers
47-
// Console "Verify" button succeeds.
4845
if (!signature || typeof signature !== "string") {
49-
if (isLineWebhookVerificationRequest(body)) {
50-
logVerbose("line: webhook verification request (empty events, no signature) - 200 OK");
51-
res.status(200).json({ status: "ok" });
52-
return;
53-
}
5446
res.status(400).json({ error: "Missing X-Line-Signature header" });
5547
return;
5648
}
5749

50+
const rawBody = readRawBody(req);
51+
5852
if (!rawBody) {
5953
res.status(400).json({ error: "Missing raw request body for signature verification" });
6054
return;
6155
}
56+
if (Buffer.byteLength(rawBody, "utf-8") > LINE_WEBHOOK_MAX_RAW_BODY_BYTES) {
57+
res.status(413).json({ error: "Payload too large" });
58+
return;
59+
}
6260

6361
if (!validateLineSignature(rawBody, signature, channelSecret)) {
6462
logVerbose("line: webhook signature validation failed");
6563
res.status(401).json({ error: "Invalid signature" });
6664
return;
6765
}
6866

67+
const body = parseWebhookBody(req, rawBody);
68+
6969
if (!body) {
7070
res.status(400).json({ error: "Invalid webhook payload" });
7171
return;

0 commit comments

Comments
 (0)