regression: broken incoming webhook validation

apps/meteor/app/integrations/server/api/api.ts

@@ -294,7 +294,7 @@ function integrationInfoRest(): { statusCode: number; body: { success: boolean }
 class WebHookAPI extends APIClass<'/hooks'> {
 	async authenticatedRoute(this: IntegrationThis): Promise<IUser | null> {
 		const { integrationId, token } = this.urlParams;
-		const integration = await Integrations.findOneById<IIncomingIntegration>(integrationId);
+		const integration = await Integrations.findOneByIdAndToken<IIncomingIntegration>(integrationId, decodeURIComponent(token));
 
 		if (!integration) {
 			incomingLogger.info(`Invalid integration id ${integrationId} or token ${token}`);

apps/meteor/tests/end-to-end/api/incoming-integrations.ts

@@ -889,7 +889,7 @@ describe('[Incoming Integrations]', () => {
 		});
 	});
 
-	describe('Additional Tests for Message Delivery Permissions', () => {
+	describe('Additional Tests for Message Delivery Permissions And Authentication', () => {
 		let nonMemberUser: IUser;
 		let privateTeam: ITeam;
 		let publicChannelInPrivateTeam: IRoom;
@@ -1009,6 +1009,58 @@ describe('[Incoming Integrations]', () => {
 			]);
 		});
 
+		it('should not send a message in public room if token is invalid', async () => {
+			const successfulMesssage = `Message sent successfully at #${Random.id()}`;
+			await request
+				.post(`/hooks/${integration4._id}/invalid-token`)
+				.send({
+					text: successfulMesssage,
+				})
+				.expect(500)
+				.expect((res) => {
+					expect(res.text).to.be.equal('Internal Server Error');
+				});
+			await request
+				.get(api('channels.messages'))
+				.set(credentials)
+				.query({
+					roomId: publicRoom._id,
+				})
+				.expect('Content-Type', 'application/json')
+				.expect(200)
+				.expect((res) => {
+					expect(res.body).to.have.property('success', true);
+					expect(res.body).to.have.property('messages').and.to.be.an('array');
+					expect((res.body.messages as IMessage[]).find((m) => m.msg === successfulMesssage)).to.be.undefined;
+				});
+		});
+
+		it('should not send a message in private room if token is invalid', async () => {
+			const successfulMesssage = `Message sent successfully at #${Random.id()}`;
+			await request
+				.post(`/hooks/${integration2._id}/invalid-token`)
+				.send({
+					text: successfulMesssage,
+				})
+				.expect(500)
+				.expect((res) => {
+					expect(res.text).to.be.equal('Internal Server Error');
+				});
+			await request
+				.get(api('groups.messages'))
+				.set(credentials)
+				.query({
+					roomId: privateRoom._id,
+				})
+				.expect('Content-Type', 'application/json')
+				.expect(200)
+				.expect((res) => {
+					expect(res.body).to.have.property('success', true);
+					expect(res.body).to.have.property('messages').and.to.be.an('array');
+					expect((res.body.messages as IMessage[]).find((m) => m.msg === successfulMesssage)).to.be.undefined;
+				});
+		});
+
 		it('should not send a message to a private rooms on behalf of a non member', async () => {
 			const successfulMesssage = `Message sent successfully at #${Random.id()}`;
 			await request

packages/model-typings/src/models/IIntegrationsModel.ts

@@ -1,5 +1,5 @@
 import type { IIntegration, IUser } from '@rocket.chat/core-typings';
-import type { FindCursor } from 'mongodb';
+import type { FindCursor, FindOptions } from 'mongodb';
 
 import type { IBaseModel } from './IBaseModel';
 
@@ -10,4 +10,9 @@ export interface IIntegrationsModel extends IBaseModel<IIntegration> {
 	findOneByIdAndCreatedByIfExists(params: { _id: IIntegration['_id']; createdBy?: IUser['_id'] }): Promise<IIntegration | null>;
 	findOneByUrl(url: string): Promise<IIntegration | null>;
 	updateRoomName(oldRoomName: string, newRoomName: string): ReturnType<IBaseModel<IIntegration>['updateMany']>;
+	findOneByIdAndToken<P extends IIntegration = IIntegration>(
+		id: IIntegration['_id'],
+		token: string,
+		options?: FindOptions<P>,
+	): Promise<P | null>;
 }

packages/models/src/models/Integrations.ts

@@ -1,6 +1,6 @@
 import type { IIntegration, IUser, RocketChatRecordDeleted } from '@rocket.chat/core-typings';
 import type { IBaseModel, IIntegrationsModel } from '@rocket.chat/model-typings';
-import type { Collection, Db, FindCursor, IndexDescription } from 'mongodb';
+import type { Collection, Db, FindCursor, FindOptions, IndexDescription } from 'mongodb';
 
 import { BaseRaw } from './BaseRaw';
 
@@ -57,4 +57,12 @@ export class IntegrationsRaw extends BaseRaw<IIntegration> implements IIntegrati
 	findByChannels(channels: IIntegration['channel']): FindCursor<IIntegration> {
 		return this.find({ channel: { $in: channels } });
 	}
+
+	findOneByIdAndToken<P extends IIntegration = IIntegration>(
+		id: IIntegration['_id'],
+		token: string,
+		options?: FindOptions<P>,
+	): Promise<P | null> {
+		return this.findOne<P>({ _id: id, token }, options);
+	}
 }