fix: handle missing checksum in API requests

API requests with missing checksums were causing an uncaught exception
that made the application return an incorrect 200 response to callers.
The expected behavior is for it to return a 200 response with a
`checksumError` key in its XML response body.

Correctly handle missing checksum when checking whether its valid on API
requests.

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file.
 
+### UNRELEASED
+
+* fix: handle missing checksum in API requests
+
 ### v3.2.1
 
 * fix: catch all HTTPServer errors in the prom module

src/out/webhooks/utils.js

@@ -131,6 +131,9 @@ const checksumAPI = (fullUrl, salt, algorithm) => {
 const isUrlChecksumValid = (urlStr, secret, supportedAlgorithms) => {
   const urlObj = url.parse(urlStr, true);
   const checksum = urlObj.query["checksum"];
+
+  if (!checksum || typeof checksum !== "string") return false;
+
   const algorithm = getChecksumAlgorithmFromLength(checksum.length);
 
   if (!isChecksumAlgorithmSupported(algorithm, supportedAlgorithms)) {

test/webhooks/index.js

@@ -117,7 +117,7 @@ export default function suite({
   });
 
   describe('GET /hooks/create getRaw hook', () => {
-    after( (done) => {
+    after((done) => {
       const hooks = Hook.get().getAllGlobalHooks();
       Hook.get().removeSubscription(hooks[hooks.length-1].id)
         .then(() => { done(); })
@@ -146,6 +146,21 @@ export default function suite({
     })
   });
 
+  describe('GET /hooks/create without checksum', () => {
+    it('should return 200 response with checksumError key', (done) => {
+      request(Helpers.url)
+        .get(Helpers.createUrl)
+        .expect('Content-Type', /text\/xml/)
+        .expect(200, (err, res) => {
+          if (res.text.includes('checksumError')) {
+            done();
+          } else {
+            done(new Error("Incorrect checksumError response: " + res.text));
+          }
+        })
+    })
+  });
+
   describe('/POST mapped message', () => {
     let catcher;