fix(aws_lambda): handle null headers, query string, and body in API Gateway events

API Gateway sends null, not a missing key, for request fields that have
no value. For example "headers", "multiValueHeaders" and
"queryStringParameters" are null when the request has none of them.
The Lambda adapter assumed these were always dicts and raised
AttributeError before the request was dispatched. It also raised
KeyError when "isBase64Encoded" was absent, and TypeError when the
flag was true but the body was null.

- Treat None the same as a missing key for every event field
- Copy the headers dict so the caller's event is not modified
- Add tests for null fields, a missing base64 flag, and a real
  base64-encoded body

Author: sahiljagtap08

slack_bolt/adapter/aws_lambda/handler.py

@@ -71,22 +71,26 @@ def handle(self, event, context):
 
 
 def to_bolt_request(event) -> BoltRequest:
-    body = event.get("body", "")
-    if event["isBase64Encoded"]:
+    # API Gateway sends null (not a missing key) for fields that have no value,
+    # such as "headers", "multiValueHeaders" and "queryStringParameters".
+    # Every lookup below treats None the same as a missing key.
+    body = event.get("body") or ""
+    if event.get("isBase64Encoded") is True and body:
         body = base64.b64decode(body).decode("utf-8")
-    cookies: Sequence[str] = event.get("cookies", [])
-    if cookies is None or len(cookies) == 0:
+    cookies: Sequence[str] = event.get("cookies") or []
+    if len(cookies) == 0:
         # In the case of format v1
-        multiValueHeaders = event.get("multiValueHeaders", {})
-        cookies = multiValueHeaders.get("cookie", [])
+        multiValueHeaders = event.get("multiValueHeaders") or {}
+        cookies = multiValueHeaders.get("cookie") or []
         if len(cookies) == 0:
             # Try using uppercase
-            cookies = multiValueHeaders.get("Cookie", [])
-    headers = event.get("headers", {})
+            cookies = multiValueHeaders.get("Cookie") or []
+    # Copy the headers so the caller's event dict is left untouched
+    headers = dict(event.get("headers") or {})
     headers["cookie"] = cookies
     return BoltRequest(
         body=body,
-        query=event.get("queryStringParameters", {}),
+        query=event.get("queryStringParameters") or {},
         headers=headers,
     )
 

tests/adapter_tests/aws/test_aws_lambda.py

@@ -1,3 +1,4 @@
+import base64
 import json
 from time import time
 from urllib.parse import quote
@@ -70,6 +71,61 @@ def test_not_found(self):
         response = not_found()
         assert response["statusCode"] == 404
 
+    def test_null_fields_in_api_gateway_event(self):
+        # API Gateway sends null for headers, multiValueHeaders and queryStringParameters
+        # when the request has none. These used to crash before the request was dispatched.
+        app = App(client=self.web_client, signing_secret=self.signing_secret)
+        event = {
+            "httpMethod": "POST",
+            "requestContext": {"httpMethod": "POST"},
+            "headers": None,
+            "multiValueHeaders": None,
+            "queryStringParameters": None,
+            "body": "{}",
+            "isBase64Encoded": False,
+        }
+        response = SlackRequestHandler(app).handle(event, self.context)
+        # No signature headers, so the request is rejected rather than crashing
+        assert response["statusCode"] == 401
+        # The caller's event must not be modified
+        assert event["headers"] is None
+
+    def test_missing_is_base64_encoded_and_null_body(self):
+        app = App(client=self.web_client, signing_secret=self.signing_secret)
+        # isBase64Encoded is absent (for example when invoked from a test tool)
+        event = {"requestContext": {"http": {"method": "POST"}}, "headers": {}, "body": "{}"}
+        assert SlackRequestHandler(app).handle(event, self.context)["statusCode"] == 401
+        # isBase64Encoded is true but the body is null
+        event = {"requestContext": {"http": {"method": "POST"}}, "headers": {}, "body": None, "isBase64Encoded": True}
+        assert SlackRequestHandler(app).handle(event, self.context)["statusCode"] == 401
+
+    def test_base64_encoded_body(self):
+        app = App(client=self.web_client, signing_secret=self.signing_secret)
+
+        def event_handler():
+            pass
+
+        app.event("app_mention")(event_handler)
+        input = {
+            "token": "verification_token",
+            "team_id": "T111",
+            "api_app_id": "A111",
+            "event": {"type": "app_mention", "text": "<@W111> Hi", "user": "W222", "team": "T111", "channel": "C111"},
+            "type": "event_callback",
+            "event_id": "Ev111",
+            "event_time": 1595926230,
+        }
+        timestamp, body = str(int(time())), json.dumps(input)
+        event = {
+            "body": base64.b64encode(body.encode("utf-8")).decode("ascii"),
+            "queryStringParameters": None,
+            "headers": self.build_headers(timestamp, body),
+            "requestContext": {"http": {"method": "POST"}},
+            "isBase64Encoded": True,
+        }
+        response = SlackRequestHandler(app).handle(event, self.context)
+        assert response["statusCode"] == 200
+
     def test_first_value(self):
         assert _first_value({"foo": [1, 2, 3]}, "foo") == 1
         assert _first_value({"foo": []}, "foo") is None