Prevent leak of slack secrets

claudiajs / claudia-bot-builder

Create chat bots for Facebook Messenger, Slack, Amazon Alexa, Skype, Telegram, Viber, Line, GroupMe, Kik and Twilio and deploy to AWS Lambda in minutes

https://claudiajs.com/claudia-bot-builder.html

MIT License

1.84k stars 252 forks source link

Prevent leak of slack secrets #35

Closed guillemsalas closed 7 years ago

guillemsalas commented 7 years ago

Remove request.env.slackToken, request.env.slackWebhookToken and request.env.slackVerificationToken from invalid request response body. This prevents leaking secrets, since before the fix they were displayed to any request that does not come with the right slack token.

simalexan commented 7 years ago

@guillemsalas thank you for noticing! 👍 you have a beer when we come to Barcelona, the issue sneaked in through one of the last PRs

guillemsalas commented 7 years ago

@simalexan It will be a pleasure :smiley: