fix(slack): fail closed without webhook secret

Author: waleedlatif1

apps/sim/app/api/webhooks/slack/route.test.ts

@@ -99,6 +99,16 @@ describe('Slack app webhook route', () => {
     expect(mockHandleSlackChallenge).not.toHaveBeenCalled()
   })
 
+  it('treats a whitespace-only native signing secret as unconfigured', async () => {
+    setEnv({ SLACK_SIGNING_SECRET: '   ' })
+
+    const response = await run(messageBody)
+
+    expect(response.status).toBe(500)
+    expect(mockVerifySlackRequestSignature).not.toHaveBeenCalled()
+    expect(mockFindWebhooksByRoutingKey).not.toHaveBeenCalled()
+  })
+
   it('verifies a signed request before answering the verification challenge', async () => {
     const body = { type: 'url_verification', challenge: 'challenge' }
     mockHandleSlackChallenge.mockReturnValue(new Response('challenge', { status: 200 }))

apps/sim/lib/webhooks/providers/slack.test.ts

@@ -1,3 +1,4 @@
+import { createHmac } from 'node:crypto'
 import { describe, expect, it } from 'vitest'
 import {
   handleSlackChallenge,
@@ -23,6 +24,66 @@ describe('slackHandler responses', () => {
   })
 })
 
+describe('slackHandler request verification', () => {
+  const rawBody = JSON.stringify({ type: 'event_callback' })
+
+  function signedRequest(signingSecret: string, timestamp: string, body = rawBody): Request {
+    const signature = createHmac('sha256', signingSecret)
+      .update(`v0:${timestamp}:${body}`, 'utf8')
+      .digest('hex')
+    return new Request('https://sim.test/api/webhooks/trigger/slack', {
+      method: 'POST',
+      headers: {
+        'x-slack-request-timestamp': timestamp,
+        'x-slack-signature': `v0=${signature}`,
+      },
+    })
+  }
+
+  function verify(request: Request, providerConfig: Record<string, unknown>, body = rawBody) {
+    return slackHandler.verifyAuth!({
+      webhook: {},
+      workflow: {},
+      request: request as unknown as import('next/server').NextRequest,
+      rawBody: body,
+      requestId: 'slack-auth-test',
+      providerConfig,
+    })
+  }
+
+  it('fails closed when a legacy Slack webhook has no signing secret', async () => {
+    const response = await verify(new Request('https://sim.test'), {})
+
+    expect(response?.status).toBe(401)
+  })
+
+  it('accepts a correctly signed current request', async () => {
+    const signingSecret = 'test-signing-secret'
+    const timestamp = String(Math.floor(Date.now() / 1000))
+
+    expect(verify(signedRequest(signingSecret, timestamp), { signingSecret })).toBeNull()
+  })
+
+  it('rejects a signature computed for different raw bytes', async () => {
+    const signingSecret = 'test-signing-secret'
+    const timestamp = String(Math.floor(Date.now() / 1000))
+    const request = signedRequest(signingSecret, timestamp)
+
+    const response = await verify(request, { signingSecret }, `${rawBody} `)
+
+    expect(response?.status).toBe(401)
+  })
+
+  it("rejects an otherwise valid signature outside Slack's five-minute replay window", async () => {
+    const signingSecret = 'test-signing-secret'
+    const timestamp = String(Math.floor(Date.now() / 1000) - 301)
+
+    const response = await verify(signedRequest(signingSecret, timestamp), { signingSecret })
+
+    expect(response?.status).toBe(401)
+  })
+})
+
 describe('slackHandler formatInput - Events API', () => {
   it('maps an app_mention event', async () => {
     const { input } = await slackHandler.formatInput!(

apps/sim/lib/webhooks/providers/slack.ts

@@ -840,7 +840,8 @@ export const slackHandler: WebhookProviderHandler = {
   verifyAuth({ request, rawBody, requestId, providerConfig }: AuthContext) {
     const signingSecret = providerConfig.signingSecret as string | undefined
     if (!signingSecret) {
-      return null
+      logger.warn(`[${requestId}] Slack webhook signing secret not configured`)
+      return new NextResponse('Unauthorized - Missing Slack signing secret', { status: 401 })
     }
     return verifySlackRequestSignature(signingSecret, request, rawBody, requestId)
   },