From 87cba89bc68ffd8da4ba90f564bdb7b3220d476f Mon Sep 17 00:00:00 2001 From: manisha1997 Date: Tue, 2 Dec 2025 16:45:42 +0530 Subject: [PATCH 1/3] chore: URL query percent encoded --- spec/framework/request_spec.rb | 126 +++++++++++++++++++++++++++++---- 1 file changed, 111 insertions(+), 15 deletions(-) diff --git a/spec/framework/request_spec.rb b/spec/framework/request_spec.rb index 48ed577a0..92ae72419 100644 --- a/spec/framework/request_spec.rb +++ b/spec/framework/request_spec.rb @@ -1,8 +1,8 @@ require 'spec_helper' describe Twilio::Request do - before do - @request = Twilio::Request.new('host', + it 'should initialize readers correctly' do + request = Twilio::Request.new('host', 'port', 'POST', 'url', @@ -11,26 +11,122 @@ { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, ['a', 'b'], 'timeout') - end - - it 'should initialize readers correctly' do - expect(@request.host).to eq('host') - expect(@request.port).to eq('port') - expect(@request.method).to eq('POST') - expect(@request.url).to eq('url') - expect(@request.params).to eq('param-key' => 'param-value', 'param-keytwo' => 'param-valuetwo') - expect(@request.data).to eq('data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo') - expect(@request.headers).to eq('header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo') - expect(@request.auth).to eq(['a', 'b']) - expect(@request.timeout).to eq('timeout') + expect(request.host).to eq('host') + expect(request.port).to eq('port') + expect(request.method).to eq('POST') + expect(request.url).to eq('url') + expect(request.params).to eq('param-key' => 'param-value', 'param-keytwo' => 'param-valuetwo') + expect(request.data).to eq('data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo') + expect(request.headers).to eq('header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo') + expect(request.auth).to eq(['a', 'b']) + expect(request.timeout).to eq('timeout') end it 'should be represented correctly' do + request = Twilio::Request.new('host', + 'port', + 'POST', + 'url', + { 'param-key' => 'param-value', 'param-keytwo' => 'param-valuetwo' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') expected_string = %((a,b) POST url?param-key=param-value¶m-keytwo=param-valuetwo) + %(\n-d "data-key"="data-value") + %(\n-d "data-keytwo"="data-valuetwo") + %(\n-H "header-key": "header-value") + %(\n-H "header-keytwo": "header-valuetwo") - expect(@request.to_s).to eq(expected_string) + expect(request.to_s).to eq(expected_string) + end + + it 'should be percent encode properly' do + request = Twilio::Request.new('host', + 'port', + 'POST', + 'url', + { 'param-key' => ':/?#[]@' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') + expected_string = %((a,b) POST url?param-key=%3A%2F%3F%23%5B%5D%40) + + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") + expect(request.to_s).to eq(expected_string) + end + + it 'should be percent encode properly for sub delimiters' do + request = Twilio::Request.new('host', + 'port', + 'POST', + 'url', + { 'param-key' => '!$&\'()*+,;=' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') + expected_string = %((a,b) POST url?param-key=%21%24%26%27%28%29%2A%2B%2C%3B%3D) + + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") + expect(request.to_s).to eq(expected_string) + end + + it 'should be percent encode percent encode' do + request = Twilio::Request.new('host', + 'port', + 'POST', + 'url', + { 'param-key' => '%25' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') + expected_string = %((a,b) POST url?param-key=%2525) + + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") + expect(request.to_s).to eq(expected_string) + end + + it 'should be not percent encode these characters' do + request = Twilio::Request.new('host', + 'port', + 'POST', + 'url', + { 'param-key' => '-._~' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') + expected_string = %((a,b) POST url?param-key=-._~) + + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") + expect(request.to_s).to eq(expected_string) + end + + it 'tests parameter sanitation by encoding to prevent injection and XSS attacks' do + request = Twilio::Request.new('host', + 'port', + 'POST', + 'url', + { 'param-key' => 'https://malicious.com/?q=' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') + expected_string = %((a,b) POST url?param-key=https%3A%2F%2Fmalicious.com%2F%3Fq%3D%3Cscript%3Ealert%28%22xss%22%29%3C%2Fscript%3E) + + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") + expect(request.to_s).to eq(expected_string) end end From 79326fb8a988f3330418bb2f1df5705c3cf2ded4 Mon Sep 17 00:00:00 2001 From: manisha1997 Date: Tue, 2 Dec 2025 16:50:10 +0530 Subject: [PATCH 2/3] chore: URL query percent encoded --- spec/framework/request_spec.rb | 72 +++++++++++++++++----------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/spec/framework/request_spec.rb b/spec/framework/request_spec.rb index 92ae72419..423e6af09 100644 --- a/spec/framework/request_spec.rb +++ b/spec/framework/request_spec.rb @@ -3,14 +3,14 @@ describe Twilio::Request do it 'should initialize readers correctly' do request = Twilio::Request.new('host', - 'port', - 'POST', - 'url', - { 'param-key' => 'param-value', 'param-keytwo' => 'param-valuetwo' }, - { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, - { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, - ['a', 'b'], - 'timeout') + 'port', + 'POST', + 'url', + { 'param-key' => 'param-value', 'param-keytwo' => 'param-valuetwo' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') expect(request.host).to eq('host') expect(request.port).to eq('port') expect(request.method).to eq('POST') @@ -24,14 +24,14 @@ it 'should be represented correctly' do request = Twilio::Request.new('host', - 'port', - 'POST', - 'url', - { 'param-key' => 'param-value', 'param-keytwo' => 'param-valuetwo' }, - { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, - { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, - ['a', 'b'], - 'timeout') + 'port', + 'POST', + 'url', + { 'param-key' => 'param-value', 'param-keytwo' => 'param-valuetwo' }, + { 'data-key' => 'data-value', 'data-keytwo' => 'data-valuetwo' }, + { 'header-key' => 'header-value', 'header-keytwo' => 'header-valuetwo' }, + ['a', 'b'], + 'timeout') expected_string = %((a,b) POST url?param-key=param-value¶m-keytwo=param-valuetwo) + %(\n-d "data-key"="data-value") + %(\n-d "data-keytwo"="data-valuetwo") + @@ -51,10 +51,10 @@ ['a', 'b'], 'timeout') expected_string = %((a,b) POST url?param-key=%3A%2F%3F%23%5B%5D%40) + - %(\n-d "data-key"="data-value") + - %(\n-d "data-keytwo"="data-valuetwo") + - %(\n-H "header-key": "header-value") + - %(\n-H "header-keytwo": "header-valuetwo") + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") expect(request.to_s).to eq(expected_string) end @@ -69,10 +69,10 @@ ['a', 'b'], 'timeout') expected_string = %((a,b) POST url?param-key=%21%24%26%27%28%29%2A%2B%2C%3B%3D) + - %(\n-d "data-key"="data-value") + - %(\n-d "data-keytwo"="data-valuetwo") + - %(\n-H "header-key": "header-value") + - %(\n-H "header-keytwo": "header-valuetwo") + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") expect(request.to_s).to eq(expected_string) end @@ -87,10 +87,10 @@ ['a', 'b'], 'timeout') expected_string = %((a,b) POST url?param-key=%2525) + - %(\n-d "data-key"="data-value") + - %(\n-d "data-keytwo"="data-valuetwo") + - %(\n-H "header-key": "header-value") + - %(\n-H "header-keytwo": "header-valuetwo") + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") expect(request.to_s).to eq(expected_string) end @@ -105,10 +105,10 @@ ['a', 'b'], 'timeout') expected_string = %((a,b) POST url?param-key=-._~) + - %(\n-d "data-key"="data-value") + - %(\n-d "data-keytwo"="data-valuetwo") + - %(\n-H "header-key": "header-value") + - %(\n-H "header-keytwo": "header-valuetwo") + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") expect(request.to_s).to eq(expected_string) end @@ -123,10 +123,10 @@ ['a', 'b'], 'timeout') expected_string = %((a,b) POST url?param-key=https%3A%2F%2Fmalicious.com%2F%3Fq%3D%3Cscript%3Ealert%28%22xss%22%29%3C%2Fscript%3E) + - %(\n-d "data-key"="data-value") + - %(\n-d "data-keytwo"="data-valuetwo") + - %(\n-H "header-key": "header-value") + - %(\n-H "header-keytwo": "header-valuetwo") + %(\n-d "data-key"="data-value") + + %(\n-d "data-keytwo"="data-valuetwo") + + %(\n-H "header-key": "header-value") + + %(\n-H "header-keytwo": "header-valuetwo") expect(request.to_s).to eq(expected_string) end end From 4f52ffc0b537bbbc5215182cf225751e4be22eff Mon Sep 17 00:00:00 2001 From: manisha1997 Date: Tue, 2 Dec 2025 16:54:33 +0530 Subject: [PATCH 3/3] chore: URL query percent encoded --- .github/workflows/test-and-deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test-and-deploy.yml b/.github/workflows/test-and-deploy.yml index 87139fd1d..891891ccd 100644 --- a/.github/workflows/test-and-deploy.yml +++ b/.github/workflows/test-and-deploy.yml @@ -17,7 +17,7 @@ jobs: timeout-minutes: 20 strategy: matrix: - ruby: [ '2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', 'jruby-9.3', 'jruby-9.4' ] + ruby: [ '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', 'jruby-9.3', 'jruby-9.4' ] steps: - name: Checkout twilio-ruby uses: actions/checkout@v3