Add sample Facebook Messenger webhook server and README - #1239
Add sample Facebook Messenger webhook server and README#1239quynhhx01042006-bit wants to merge 1 commit into
Conversation
Adds a small Express webhook and README with ngrok/testing steps. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@webhook-server/README.md`:
- Around line 8-9: Update the environment-variable setup instructions in the
README to provide separate commands for Command Prompt, PowerShell, and POSIX
shells, ensuring PAGE_ACCESS_TOKEN and VERIFY_TOKEN use syntax valid for each
shell.
- Around line 25-26: Update the Graph API version in the README subscription
curl example to a currently supported version such as v26.0, and add a brief
note documenting that this version must be maintained as Facebook’s supported
API range changes.
In `@webhook-server/server.js`:
- Around line 22-25: Remove the stray standalone n before the webhook
event-handling comment inside the /webhook POST handler, ensuring the handler
proceeds from the console.log call to the req.body.object check without
evaluating an undefined identifier.
- Around line 29-35: Update the message logging in the event.message branch to
serialize the senderId and text values before passing them to console.log, using
JSON.stringify or equivalent structured logging. Preserve the existing log
context and behavior while preventing sender-controlled newlines from creating
forged log entries.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e7f99ca1-7e1f-44ef-896e-0d22233d21b3
📒 Files selected for processing (2)
webhook-server/README.mdwebhook-server/server.js
| set VERIFY_TOKEN=your_verify_token_here # Windows PowerShell: $env:VERIFY_TOKEN = "..." | ||
| set PAGE_ACCESS_TOKEN=your_page_access_token_here |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use shell-specific environment-variable commands.
Line 9 uses Command Prompt syntax. PowerShell users will not set PAGE_ACCESS_TOKEN. Show separate commands for Command Prompt, PowerShell, and POSIX shells.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webhook-server/README.md` around lines 8 - 9, Update the environment-variable
setup instructions in the README to provide separate commands for Command
Prompt, PowerShell, and POSIX shells, ensuring PAGE_ACCESS_TOKEN and
VERIFY_TOKEN use syntax valid for each shell.
| Using Graph API (replace PAGE_ID and PAGE_ACCESS_TOKEN): | ||
| curl -X POST "https://graph.facebook.com/v17.0/PAGE_ID/subscribed_apps?access_token=PAGE_ACCESS_TOKEN" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
On the official Meta Graph API versioning documentation, is Graph API v17.0supported on August 5, 2026? Which supported Graph API version should be used for the/{page-id}/subscribed_apps endpoint?
💡 Result:
On the official Meta Graph API documentation, Graph API v17.0 is not supported on August 5, 2026. According to the Meta Graph API changelog, v17.0 reached its end-of-life on September 12, 2025 [1][2][3]. For the /{page-id}/subscribed_apps endpoint, you should use the latest supported Graph API version, which is currently v26.0 [1][4][5]. Meta recommends using the most recent version to ensure access to the latest features and security updates [6][7].
Citations:
- 1: https://developers.facebook.com/docs/graph-api/changelog/
- 2: https://developers.facebook.com/docs/graph-api/changelog/versions/
- 3: https://developers.facebook.com/docs/graph-api/changelog/version17.0/
- 4: https://developers.facebook.com/docs/graph-api/reference/page/subscribed_apps/
- 5: https://developers.facebook.com/docs/graph-api/reference/page/
- 6: https://developers.facebook.com/docs/graph-api
- 7: https://developers.facebook.com/docs/graph-api/advanced/api-upgrade/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repository files matching webhook-server/README.md =="
git ls-files | grep -F 'webhook-server/README.md' || true
echo
echo "== current webhook-server/README.md lines 18-32 =="
sed -n '18,32p' webhook-server/README.md | cat -n
echo
echo "== Graph API version mentions in webhook-server =="
rg -n "graph\.facebook\.com|subscribed_apps|api-version|api version|Graph API version|v17\.0|v26\.0" webhook-server || trueRepository: f/prompts.chat
Length of output: 1422
Use a supported Graph API version in the subscription command.
v17.0 reached end-of-life outside the current supported range. Update the curl example to a supported version such as v26.0 and document the Graph API version maintenance requirement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webhook-server/README.md` around lines 25 - 26, Update the Graph API version
in the README subscription curl example to a currently supported version such as
v26.0, and add a brief note documenting that this version must be maintained as
Facebook’s supported API range changes.
| app.post('/webhook', (req, res) => { | ||
| console.log('Webhook event:', JSON.stringify(req.body, null, 2)); | ||
| n // Basic handling: iterate entries and messaging events | ||
| if (req.body.object === 'page') { |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Remove the stray n before the event handler logic.
Line 24 evaluates n as an identifier. Every POST request then throws ReferenceError before the handler can return HTTP 200.
- n // Basic handling: iterate entries and messaging events
+ // Basic handling: iterate entries and messaging events📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| app.post('/webhook', (req, res) => { | |
| console.log('Webhook event:', JSON.stringify(req.body, null, 2)); | |
| n // Basic handling: iterate entries and messaging events | |
| if (req.body.object === 'page') { | |
| app.post('/webhook', (req, res) => { | |
| console.log('Webhook event:', JSON.stringify(req.body, null, 2)); | |
| // Basic handling: iterate entries and messaging events | |
| if (req.body.object === 'page') { |
🧰 Tools
🪛 ast-grep (0.45.0)
[warning] 22-22: Logging request-derived input unsanitized allows log forging (CRLF injection); strip newlines / encode the value before logging.
Context: console.log('Webhook event:', JSON.stringify(req.body, null, 2))
Note: [CWE-117] Improper Output Neutralization for Logs. OWASP A09:2021 Security Logging and Monitoring Failures.
(log-injection-javascript)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webhook-server/server.js` around lines 22 - 25, Remove the stray standalone n
before the webhook event-handling comment inside the /webhook POST handler,
ensuring the handler proceeds from the console.log call to the req.body.object
check without evaluating an undefined identifier.
| if (event.message) { | ||
| const senderId = event.sender.id; | ||
| const text = event.message.text; | ||
| console.log(`Message from ${senderId}: ${text}`); | ||
| // TODO: reply using Send API with PAGE_ACCESS_TOKEN | ||
| } else if (event.postback) { | ||
| console.log('Postback:', event.postback); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- file excerpt ---\n'
sed -n '1,80p' webhook-server/server.js
printf '\n--- relevant logging patterns ---\n'
rg -n "console\\.(log|error|warn|info)|senderId|event\\.message|event\\.sender" webhook-server/server.js
printf '\n--- deterministic newline-injection probes ---\n'
node - <<'JS'
const senderId = 'ALICE\n[BOT] MALICE: injected line';
const text = 'ok\n[YOUR MESSAGE] forged entry';
console.log(`Message from ${senderId}: ${text}`);
JSRepository: f/prompts.chat
Length of output: 243
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- file excerpt ---'
sed -n '1,80p' webhook-server/server.js
echo
echo '--- relevant logging patterns ---'
rg -n "console\\.|senderId|event\\.message|event\\.sender" webhook-server/server.js || true
echo
echo '--- deterministic newline-injection probes ---'
node - <<'JS'
const senderId = 'ALICE\n[BOT] MALICE: injected line';
const text = 'ok\n[YOUR MESSAGE] forged entry';
console.log(`Message from ${senderId}: ${text}`);
JSRepository: f/prompts.chat
Length of output: 2265
Log Injection (CWE-117)
Reachability: External · Exploitability: Trivial
Encode sender-controlled data before logging.
console.log includes event.sender.id and event.message.text directly, so newline characters can create forged or fragmented log entries. Serialize each field with JSON.stringify or use structured logging before writing it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@webhook-server/server.js` around lines 29 - 35, Update the message logging in
the event.message branch to serialize the senderId and text values before
passing them to console.log, using JSON.stringify or equivalent structured
logging. Preserve the existing log context and behavior while preventing
sender-controlled newlines from creating forged log entries.
Source: Linters/SAST tools
1 participant
Description
Adds a minimal Node/Express webhook and README to help developers test and integrate with the Facebook Messenger Send API and webhooks. This provides a local development example (ngrok instructions) and a basic webhook handler that logs incoming messaging events.
Type of Change
Please don't edit
prompts.csvdirectly!N/A
Additional Notes
Files added:
Testing:
Notes:
Summary
Testing