fix: fix slash escaping when calculating webhook signature (box/box-codegen#736)

.codegen.json

@@ -1 +1 @@
-{ "engineHash": "20cb559", "specHash": "630fc85", "version": "1.14.0" }
+{ "engineHash": "70390f5", "specHash": "630fc85", "version": "1.14.0" }

box_sdk_gen/internal/utils.py

@@ -410,8 +410,6 @@ def replace_char(match):
             return '\\r'
         elif char == '\t':
             return '\\t'
-        elif char == '\\':
-            return '\\\\'
         elif code_point <= 0xFFFF:  # Basic Multilingual Plane (BMP)
             return f"\\u{code_point:04x}"
         else:  # Supplementary Plane (Surrogate Pair)
@@ -420,8 +418,11 @@ def replace_char(match):
             low_surrogate = 0xDC00 + (code_point & 0x3FF)
             return f"\\u{high_surrogate:04x}\\u{low_surrogate:04x}"
 
-    # Match special characters, non-ASCII characters, and backslashes
-    return re.sub(r'[^\x20-\x7e]|[\n\r\t\\]', replace_char, value)
+    # Replace any backslashes that are NOT part of a \/ with double backslash
+    temp = re.sub(r'\\(?!/)', r'\\\\', value)
+
+    # Match special characters, non-ASCII characters
+    return re.sub(r'[^\x20-\x7e]|[\n\r\t]', replace_char, temp)
 
 
 def compute_webhook_signature(

test/webhooks.py

@@ -83,6 +83,12 @@ def testWebhookValidation():
     body_with_carriage_return: str = (
         '{"webhook":{"id":"1234567890"},"trigger":"FILE.UPLOADED","source":{"id":"1234567890","type":"file","name":"test \r"}}'
     )
+    body_with_forward_slash: str = (
+        '{"webhook":{"id":"1234567890"},"trigger":"FILE.UPLOADED","source":{"id":"1234567890","type":"file","name":"\/"}}'
+    )
+    body_with_back_slash: str = (
+        '{"webhook":{"id":"1234567890"},"trigger":"FILE.UPLOADED","source":{"id":"1234567890","type":"file","name":"\\"}}'
+    )
     headers: Dict[str, str] = {
         'box-delivery-id': 'f96bb54b-ee16-4fc5-aa65-8c2d9e5b546f',
         'box-delivery-timestamp': '2020-01-01T00:00:00-07:00',
@@ -103,6 +109,14 @@ def testWebhookValidation():
         **headers,
         'box-signature-primary': 'SVkbKgy3dEEf2PbbzpNu2lDZS7zZ/aboU7HOZgBGrJk=',
     }
+    headers_with_forward_slash: Dict = {
+        **headers,
+        'box-signature-primary': 't41PWT5ZB6OcysnD6SDy9Ud+p9hdXxIdXqcdweyZv/Q=',
+    }
+    headers_with_back_slash: Dict = {
+        **headers,
+        'box-signature-primary': 'ERpMZwUQsGDTfj82ehdX6VvDZfvOhK5ULNfVmwVAGe0=',
+    }
     current_datetime: str = date_time_to_string(
         epoch_seconds_to_date_time(get_epoch_time_in_seconds())
     )
@@ -182,6 +196,12 @@ def testWebhookValidation():
     assert compute_webhook_signature(
         body_with_carriage_return, headers_with_carriage_return, primary_key
     ) == headers_with_carriage_return.get('box-signature-primary')
+    assert compute_webhook_signature(
+        body_with_forward_slash, headers_with_forward_slash, primary_key
+    ) == headers_with_forward_slash.get('box-signature-primary')
+    assert compute_webhook_signature(
+        body_with_back_slash, headers_with_back_slash, primary_key
+    ) == headers_with_back_slash.get('box-signature-primary')
     assert WebhooksManager.validate_message(
         body, headers_with_correct_datetime, primary_key, secondary_key=secondary_key
     )