sendgrid / sendgrid-php

The Official Twilio SendGrid PHP API Library
https://sendgrid.com
MIT License
1.49k stars 623 forks source link

Insecure Inbound Parse #1088

Open OlegKunitsyn opened 2 years ago

OlegKunitsyn commented 2 years ago

Issue Summary

Inbound Parse API does not provide any security controls against a malicious sender.

Steps to Reproduce

https://github.com/sendgrid/sendgrid-php/blob/main/USAGE.md#create-a-parse-setting

Technical Details

A backward-compatibe and quick solution might be a Message Authentication Code sent via X-MAC header i.e a salted by the API key hash of the payload.

References