slackapi / python-slack-events-api

Slack Events API adapter for Python (Flask required)
https://api.slack.com/events
MIT License
343 stars 116 forks source link

Lack of X-Slack-Request-Timestamp and/or X-Slack-Signature in requests results in 500 #75

Closed SpamapS closed 4 years ago

SpamapS commented 4 years ago

Description

I noticed that a test I wrote to simulate a user probing the events URL returned a 500 when I would have expected a 400.

What type of issue is this? (place an x in one of the [ ])

Requirements

Bug Report

Filling out the following details about bugs will help us solve your issue sooner.

Reproducible in:

slackeventsapi version: 2.2.0 python version: 3.6 OS version(s): irrelevant, but Linux and MacOS

Steps to reproduce:

  1. Make a POST request to a slack events URL without X-Slack-Events-Timestamp in the headers.
  2. Observe response of 500 and subsequent TypeError raised

Expected result:

A 400 error.

Actual result:

500 and unhandled exception.

Attachments:

SpamapS commented 4 years ago

Apologies for submitting without the form filled out, I have completed it now. The fix is quite simple, but I will need to get Spotify to sign the CLA (or confirm that they already have) to fix it myself.

SpamapS commented 4 years ago

This also affects lack of Signature, though that may want to be a separate issue as it is an entirely different part of the code that assumes this will be set. :)

SpamapS commented 4 years ago

Going deeper, it seems like the only thing this library does on errors is raise exceptions, despite the few places it appears to want to send a 403. Perhaps I missed a doc?

seratch commented 4 years ago

@SpamapS Thanks for the feedback! I just made a pull request to address this. A new patch version including the fix will be out once I've got code reviews from other maintainers.